How severe is CVE-2024-45049?

CVE-2024-45049 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-45049 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-45049?

CVE-2024-45049 affects Nixos Hydra. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-45049?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-45049 have an EU (EUVD) identifier?

Yes. CVE-2024-45049 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-41284.

When was CVE-2024-45049 published?

CVE-2024-45049 was published on 2024-08-27 and last updated on 2026-06-17.

CVE-2024-45049

CVE-2024-45049 is a high-severity vulnerability in Nixos Hydra with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 1% (45th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-41284
Weakness: CWE-306
Affected product: Nixos Hydra
Published: 2024-08-27
Last modified: 2026-06-17

Description

Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 to any Hydra package. Users are advised to upgrade. Users unable to upgrade should deny the `/api/push` route in a reverse proxy. This also breaks the "Evaluate jobset" button in the frontend.

Frequently asked questions

What is CVE-2024-45049?: Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 to any Hydra package. Users are advised to upgrade. Users unable to upgrade should deny the `/api/push` route in a reverse proxy. This also breaks the "Evaluate jobset" button in the frontend.
How severe is CVE-2024-45049?: CVE-2024-45049 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-45049 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-45049?: CVE-2024-45049 affects Nixos Hydra. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-45049?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-45049 have an EU (EUVD) identifier?: Yes. CVE-2024-45049 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-41284.
When was CVE-2024-45049 published?: CVE-2024-45049 was published on 2024-08-27 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:nixos:hydra:*:*:*:*:*:*:*:*

More vulnerabilities in Nixos Hydra

CVE-2025-54864 — High (CVSS 7.5): Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and…
CVE-2025-54800 — Medium (CVSS 6.1): Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can…
CVE-2024-32657 — Medium (CVSS 4.6): Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser…
CVE-2025-32435 — Low (CVSS 2.6): Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could…

All CVEs affecting Nixos Hydra →

Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities

CVE-2026-54309 — Critical (CVSS 10.0): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP…
CVE-2026-50242 — Critical (CVSS 10.0): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
CVE-2026-49257 — Critical (CVSS 10.0): mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1…
CVE-2026-46846 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46803 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46800 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).…

Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →