Authentication Bypass in Hydra CI Service Affects Nix Projects

CVE-2025-54864

What is CVE-2025-54864?

Hydra, a continuous integration service optimized for Nix projects, has a vulnerability where the endpoints /api/push-github and /api/push-gitea do not utilize HTTP Basic authentication prior to a specific commit. Although these endpoints utilize HMAC signing with a secret key, this lack of authentication could be exploited to launch denial of service attacks, especially when performing large evaluations that put additional strain on the server infrastructure. Affected users are encouraged to upgrade to the patched version or implement a reverse proxy to block these API calls for enhanced security.

References