Cyber Posture

CVE-2026-44592

Critical

Published: 14 May 2026

Published
14 May 2026
Modified
14 May 2026
KEV Added
Patch
CVSS Score 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
EPSS Score N/A
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-44592 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability. Its CVSS base score is 9.4 (Critical).

Operationally, it is not currently listed in the CISA KEV catalog.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-306 CWE-862

Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.

addresses: CWE-306 CWE-862

Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.

addresses: CWE-862 CWE-306

Always invoking the reference monitor prevents missing authorization checks for protected resources.

addresses: CWE-306 CWE-862

Auditing sessions makes it possible to detect access to critical functions without required authentication.

addresses: CWE-306 CWE-862

The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.

addresses: CWE-306 CWE-862

Certification assesses that critical functions have required authentication controls in place.

addresses: CWE-862 CWE-306

Requiring authorization servers ensures authorization is performed for protected functions.

addresses: CWE-306 CWE-862

Tailoring determines which functions require authentication and selects the appropriate baseline or compensating authentication controls.

NVD Description

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting…

more

session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)

References