Hydra Continuous Integration Vulnerability: Unauthenticated Evaluations Impact Availability

CVE-2024-45049

What is CVE-2024-45049?

Hydra, a Continuous Integration service designed for Nix-based projects, contains a vulnerability that enables evaluations to be triggered without proper authentication. This flaw poses a risk to system availability, especially if large-scale evaluations are initiated. To mitigate this vulnerability, users are encouraged to apply the relevant fix from the GitHub commit. For those unable to upgrade, it is advisable to restrict access to the '/api/push' route via a reverse proxy, though this may impede the functionality of the 'Evaluate jobset' feature in the frontend interface.

References