Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wavelens |
|
No data.
No data.
References
History
Fri, 15 May 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wavelens
Wavelens gradient |
|
| Vendors & Products |
Wavelens
Wavelens gradient |
Thu, 14 May 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1. | |
| Title | Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning | |
| Weaknesses | CWE-306 CWE-345 CWE-862 |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-14T18:39:59.824Z
Reserved: 2026-05-06T21:49:12.425Z
Link: CVE-2026-44592
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-05-14T19:16:38.147
Modified: 2026-05-15T14:44:49.877
Link: CVE-2026-44592
Redhat
No data.