PT-2026-41018 · Wavelens · Gradient
Published
2026-05-14
·
Updated
2026-05-14
·
CVE-2026-44592
CVSS v3.1
9.4
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H |
Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar storage and the cached path table. This vulnerability is fixed in 1.1.1.
Fix
Missing Authorization
Insufficient Verification of Data Authenticity
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gradient