PatchTheCVECVE-2024-45049: Hydra is a Continuous Integration service for Nix based projects
CVE-2024-45049 is a high-severity flaw (CVSS 7.5) affecting hydra. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 to any Hydra package. Users are advised to upgrade. Users unable to upgrade should deny the `/api/push` route
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 50%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2024-08-27 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-45049?
hydra: upgrade to 2024-08-27. Exact commands for each OS are on this page.
Is CVE-2024-45049 being exploited?
CVE-2024-45049 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-45049 affect?
CVE-2024-45049 affects hydra. Severity is high (CVSS 7.5). Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can
How urgent is CVE-2024-45049?
Priority 44/100. High severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-33504 HIGH 7.2 UPGRADE Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider
- CVE-2025-54864 HIGH 7.5 UPGRADE Hydra is a continuous integration service for Nix based projects
- CVE-2025-54800 MEDIUM 6.1 UPGRADE Hydra is a continuous integration service for Nix based projects
- CVE-2025-32435 LOW 2.6 UPGRADE Hydra is a Continuous Integration service for Nix based projects
- CVE-2024-32657 MEDIUM 4.6 UPGRADE Hydra is a Continuous Integration service for Nix based projects