CVE-2026-39860: 
NixOS vulnerability analysis and mitigation

CVE-2026-39860 is a sandbox escape vulnerability in the Nix package manager that allows local users to perform arbitrary file overwrites via symlink following during fixed-output derivation (FOD) output registration. It is a bypass of the prior fix for CVE-2024-27297, introduced by PR #10178 (merged March 7, 2024). Affected versions span multiple branches: ≥2.18.2 through 2.18.9, ≥2.19.4 through 2.19.7, ≥2.20.5 through 2.20.9, 2.21.0–2.28.5, 2.29.0–2.29.2, 2.30.0–2.30.3, 2.31.0–2.31.3, 2.32.0–2.32.6, 2.33.0–2.33.3, and 2.34.0–2.34.4. Only sandboxed Linux builds are affected; sandboxed macOS builds are not. The vulnerability carries a CVSS v3.1 base score of 9.0 (Critical) per the GitHub Security Advisory (GitHub Advisory), and 8.4 (High) per NVD scoring (Red Hat CVE).

The root cause is improper symlink resolution (CWE-61: UNIX Symbolic Link Following) during fixed-output derivation output registration. The original CVE-2024-27297 fix introduced a copy step where the build output at actualPath is copied to actualPath + ".tmp" before being renamed back — but the temporary copy destination resided inside the build chroot, which is accessible to the derivation builder. A malicious builder can replace actualPath + ".tmp" with a symlink pointing to any arbitrary filesystem location before the Nix daemon (running in the host mount namespace) performs the copy, causing the daemon to follow the symlink and overwrite the symlink target with the derivation's output contents. The specific code flaw was an inverted copy/rename order (renameFile before copyFile) that was corrected in commit 7794354, and the broader fix moves the temporary output to a store directory inaccessible to other users (GitHub Advisory, Nix Commit 7794354).

In default multi-user Nix installations, any local user permitted to submit builds to the Nix daemon (the allowed-users setting defaults to all users) can exploit this vulnerability to overwrite arbitrary files writable by the Nix daemon process — typically running as root. By crafting a malicious derivation that places a symlink at the .tmp copy destination pointing to a sensitive system file (e.g., /etc/passwd, /etc/sudoers, or an SSH authorized_keys file), an attacker can overwrite that file with controlled content, achieving full privilege escalation to root. Confidentiality and integrity impacts are both rated High, with no availability impact (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time (Feedly Intelligence). The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only low privileges (local user access with permission to submit builds) and no user interaction, making it straightforward to exploit in default multi-user configurations once an attacker has local access.

1. Gain local access: Obtain a local user account on a multi-user Linux system running a vulnerable version of Nix (any version from 2.18.2 up to the patched releases), where the user is in the allowed-users group (default: all users).
2. Craft a malicious fixed-output derivation: Write a Nix derivation expression that, as part of its build script, creates a symlink at the path $out.tmp (i.e., actualPath + ".tmp" inside the build chroot) pointing to a sensitive target file on the host filesystem, such as /etc/sudoers or /root/.ssh/authorized_keys.
3. Prepare the derivation output: Ensure the derivation's actual output ($out) contains the attacker-controlled content intended to overwrite the target file (e.g., a modified sudoers entry granting the attacker NOPASSWD root access).
4. Submit the build: Submit the malicious derivation to the Nix daemon using nix-build or equivalent. The daemon (running as root in the host mount namespace) begins output registration for the fixed-output derivation.
5. Trigger symlink follow: During output registration, the Nix daemon copies actualPath to actualPath + ".tmp" — but because the builder placed a symlink at that .tmp path inside the chroot (which maps to the same path in the host namespace), the daemon follows the symlink and writes the derivation output to the symlink's target on the host filesystem.
6. Escalate privileges: The sensitive target file is now overwritten with attacker-controlled content. For example, if /etc/sudoers was targeted, the attacker can now run sudo su to obtain a root shell (GitHub Advisory).

• File System: Unexpected modifications to sensitive files such as /etc/sudoers, /etc/passwd, /etc/shadow, /root/.ssh/authorized_keys, or other root-writable files with timestamps correlating to Nix build activity; presence of unusual .tmp symlinks inside Nix build chroot directories (typically under /tmp/nix-build-*).
• Logs: Nix daemon logs (e.g., /var/log/nix/daemon.log or systemd journal for nix-daemon.service) showing fixed-output derivation builds submitted by non-privileged users followed by unexpected file write operations; audit logs (/var/log/audit/audit.log) recording symlink creation inside build sandboxes followed by privileged file writes to paths outside the Nix store.
• Process: Unexpected privilege escalation events (e.g., sudo usage, su to root) by users shortly after submitting Nix builds; unusual child processes spawned from the nix-daemon process writing to paths outside /nix/store.
• Network: Outbound connections from the system initiated by previously unprivileged users following a Nix build, potentially indicating post-exploitation activity (GitHub Advisory).

Upgrade Nix to one of the patched versions corresponding to your current branch: 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, or 2.28.6. The fix moves the temporary output copy to a store directory inaccessible to other users, preventing symlink placement by the builder; patches for versions 2.31–2.34 also include additional hardening against abstract Unix socket-based file descriptor smuggling between fixed-output derivations (effective on kernels ≥6.12 with Landlock LSM enabled). As an interim workaround, restrict the allowed-users Nix configuration setting to only trusted users, or make the /nix/var/nix/daemon-socket directory inaccessible to untrusted users to prevent them from submitting builds to the daemon (GitHub Advisory, Red Hat CVE).

The vulnerability was reported by researcher edef1c and remediated by the NixOS security team (xokdvium), with the advisory published on April 7–8, 2026 (GitHub Advisory). Security news outlets including The Hacker Wire and SecurityOnline.info covered the disclosure, with SecurityOnline describing it as a "sandbox escape" in the Nix package manager (SecurityOnline). The Elest.io blog highlighted it as one of three critical CVEs in their April 5–12, 2026 weekly update, noting its CVSS 9.0 score. Community discussion on Mastodon (infosec.exchange) and Bluesky noted the severity of the privilege escalation path in default configurations.