TI-2025-23506 Aliases CVE-2025-32435

Hydra no restricted eval after nix-eval-jobs migration

LOW 13CWE-95Published 2025-04-15 · Updated 2025-04-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-95.

Summary

Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra user/group. This should not affect the signing keys, that are owned by the hydra-queue-runner and hydra-www users respectively.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00355 29th percentileScored 2026-11-07

Fix Fixed hydra (NixOS): 8d750265135b7e203520036a742afdf301b4013f

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NixOS	hydra	before 8d750265135b7e203520036a742afdf301b4013f	8d750265135b7e203520036a742afdf301b4013f	Patch available	CNA

hydra VendorNixOS Affected before 8d750265135b7e203520036a742afdf301b4013f Fixed in 8d750265135b7e203520036a742afdf301b4013f Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nixos:hydra::::::::	before 2025-04-11	Vulnerable	NixOS

cpe:2.3:a:nixos:hydra:*:*:*:*:*:*:*:* Versions before 2025-04-11 Vulnerable ·NixOS

Remediation

Fix · CNA hydra (NixOS) Fixed in 8d750265135b7e203520036a742afdf301b4013f

Timeline

2026-10-02 Threatist record created from CVE-2025-32435

References

Patch 1

https://github.com/NixOS/hydra/commit/8d750265135b7e203520036a742afdf301b4013f

Advisory 1

https://github.com/NixOS/hydra/security/advisories/GHSA-j7w7-965w-vjxw

Other 2

TI-2024-30161 Nix Hydra Missing authentication when triggering evaluations CVSS 3.1HIGH 7.5
TI-2025-34598 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins CVSS 4.0MEDIUM 6.9
TI-2025-34554 Hydra persistent XSS in build metrics CVSS 4.0HIGH 7.1
TI-2024-21538 Hydra has persistent XSS vulnerability serving HTML build outputs CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences