CVE-2025-54864

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This issue has been patched by commit f7bda02. A workaround involves blocking /api/push-github and /api/push-gitea via a reverse proxy.

• CWE-306

• https://github.com/NixOS/hydra/commit/f7bda020c6144913f134ec616783e57817f7686fPatch
• https://github.com/NixOS/hydra/security/advisories/GHSA-qpq3-646c-vgx9Patch, Vendor Advisory

Published

Aug 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54859Stored cross-site scripting (XSS) vulnerability in desknet's…4.8
• CVE-2025-5486The WP Email Debug plugin for WordPress is vulnerable to pri…9.8
• CVE-2025-54860Cognex In-Sight Explorer and In-Sight Camera Firmware expose…7.7
• CVE-2025-54861A reflected cross-site scripting (xss) vulnerability exists …5.4
• CVE-2025-54862Sante PACS Server web portal is vulnerable to stored cross-s…5.4
• CVE-2025-54863Radiometrics VizAir is vulnerable to exposure of the system'…9.8
• CVE-2025-54865Tilesheets MediaWiki Extension adds a table lookup parser fu…9.8
• CVE-2025-54866Wazuh is a free and open source platform used for threat pre…5.5
• CVE-2025-54867Youki is a container runtime written in Rust. Prior to versi…7
• CVE-2025-54868LibreChat is a ChatGPT clone with additional features. In ve…7.5
• CVE-2025-54869FPDI is a collection of PHP classes that facilitate reading …6
• CVE-2025-5487The AutomatorWP – Automator plugin for no-code automations, …7.2