CVE-2025-32435: Hydra no restricted eval after nix-eval-jobs migration

Severity: low (CVSS 2.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-15 · updated 2026-06-17
Weakness: CWE-95

Description

Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra user/group. This should not affect the signing keys, that are owned by the hydra-queue-runner and hydra-www users respectively.

Affected products

NixOS hydra: before 2025-04-11 — fixed in 2025-04-11

How to fix

Upgrade to a fixed version: NixOS hydra 2025-04-11. Check the vendor advisory for mitigations.

References

https://github.com/NixOS/hydra/commit/8d750265135b7e203520036a742afdf301b4013f
https://github.com/NixOS/hydra/security/advisories/GHSA-j7w7-965w-vjxw
https://github.com/NixOS/nixpkgs/pull/397919
https://github.com/nix-community/nix-eval-jobs/releases/tag/v2.28.1

Get alerted when CVE-2025-32435 or the next vulnerability affects your stack