CVE-2026-110453: Medium severity Nix Nix vulnerability
Published Oct 14, 2026
·Updated
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
Affected Software
1 affected component
Nix Nix<2.35.3
Event History
Oct 14, 2026
CVE Published
via MITRE·04:15 AM
Data Sourced
via MITRE·04:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are exposed to this issue?
The issue affects Nix versions before 2.35.3 on macOS or FreeBSD when builds are unsandboxed. Other platforms and sandboxed configurations are not identified as affected by the provided information.
2
What access does an attacker need to exploit this?
The vector is local and requires no privileges or user interaction. The issue involves connections made by build users from daemon clients.
3
What is the recommended remediation?
Upgrade Nix to version 2.35.3 or later. If upgrading is not immediately possible, avoid running builds unsandboxed on affected macOS or FreeBSD systems.