CVE-2025-54864 - Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Back Back to CVE browser

MEDIUM

Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Published Aug 12, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.38%

Description

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This issue has been patched by commit f7bda02. A workaround involves blocking /api/push-github and /api/push-gitea via a reverse proxy.

Affected products

Vendor NixOS Product Hydra Default
n/a
- Version
  < f7bda020c6144913f134ec616783e57817f7686f
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NixOS

Hydra

n/a

Version	Status	Constraints
< f7bda020c6144913f134ec616783e57817f7686f	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24265
Advisory
https://github.com/NixOS/hydra/commit/f7bda020c6144913f134ec616783e57817f7686f
x_refsource_MISCPatch
https://github.com/NixOS/hydra/security/advisories/GHSA-qpq3-646c-vgx9
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24265		Advisory
https://github.com/NixOS/hydra/commit/f7bda020c6144913f134ec616783e57817f7686f		x_refsource_MISCPatch
https://github.com/NixOS/hydra/security/advisories/GHSA-qpq3-646c-vgx9		x_refsource_CONFIRMPatchVendor Advisory