Read the docs
TI-2025-34598 Aliases CVE-2025-54864

Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This issue has been patched by commit f7bda02. A workaround involves blocking /api/push-github and /api/push-gitea via a reverse proxy.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NixOShydra< f7bda020c6144913f134ec616783e57817f7686f—No fix listedCNA
  • hydra VendorNixOS Affected < f7bda020c6144913f134ec616783e57817f7686f Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nixos:hydra:*:*:*:*:*:*:*:*before 2025-08-12VulnerableNixOS
  • cpe:2.3:a:nixos:hydra:*:*:*:*:*:*:*:* Versions before 2025-08-12 Vulnerable ·NixOS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54864

References

Patch 2

  • TI-2024-30161 Nix Hydra Missing authentication when triggering evaluations CVSS 3.1HIGH 7.5
  • TI-2025-34554 Hydra persistent XSS in build metrics CVSS 4.0HIGH 7.1
  • TI-2024-21538 Hydra has persistent XSS vulnerability serving HTML build outputs CVSS 3.1MEDIUM 5.4
  • TI-2025-23506 Hydra no restricted eval after nix-eval-jobs migration CVSS 3.1LOW 2.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences