CVE-2026-44592: Gradient CI: Missing Authentication in Worker Registration

Overview

This record describes a missing authentication issue in Gradient, a nix-based continuous integration system, affecting version 1.1.0. The worker registration endpoint under /proto can accept new workers without credentials when the discoverable setting is on. The GitHub Security Advisory states the issue is fixed in 1.1.1.

Impact

According to the record, a session created this way is granted open peer authorization, which exposes jobs from every organisation. The same session can write to binary cache storage and the cached path table. Because the record links these capabilities to arbitrary store paths, the main concerns are confidentiality of build information across organisations and integrity of cached artifacts that other users may consume.

• Confidentiality: visibility of jobs belonging to other organisations.
• Integrity: unauthorised entries in nar_storage and cached_path, which may affect systems that trust the cache.
• Availability: the record does not describe availability impact directly.

The CVSS 3.1 base score of 9.4 is reported as critical by the advisory source.

Affected products and versions

The description names Gradient 1.1.0 as affected when GRADIENT_DISCOVERABLE is true, including the NixOS module default. The record's structured affected and fixed lists are empty, so the exact affected range must be confirmed with the advisory. Whether earlier releases are affected is unknown from the available data.

Exploitation status

The CISA KEV field in the record is false, so this CVE is not reported there as actively exploited. No confirmed exploitation appears in the sources consulted. The EPSS probability is recorded as 0.00216 with a percentile of 0.11178, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

• Upgrade Gradient to 1.1.1 or later, as stated in the description of the record.
• If an immediate upgrade is not possible, restrict network reachability of the /proto endpoint to trusted hosts only. This is an inference from the description, not a vendor-confirmed workaround.
• Where discoverable worker registration is not needed, review whether the GRADIENT_DISCOVERABLE setting should be disabled. The record does not confirm that this fully removes the exposure.
• Review the NixOS module defaults in your deployments, since the record notes that the default is enabled.

Detection guidance

• Review logs for worker registrations on /proto that you do not recognise, especially from unfamiliar identifiers or sources.
• Audit nar_storage and the cached_path table for entries you cannot attribute to your own build pipeline.
• Verify the integrity of artifacts served from the cache before they are used in downstream builds.

Limitations of the available information

The record has no structured affected or fixed version data and no vendor-provided CVSS entry beyond the GitHub Security Advisory source. The source status is recorded as Deferred, so further updates may change the details. The record does not provide proof-of-concept material, and this analysis does not add any. Whether any production deployment was compromised is unknown.

Frequently asked questions

Which Gradient version is fixed for CVE-2026-44592?

According to the record description, the issue is fixed in version 1.1.1. The record does not list structured fixed versions, so confirm the details in the GitHub Security Advisory.

Is CVE-2026-44592 known to be actively exploited?

The record shows CISA KEV as not listed, and no confirmed exploitation appears in the sources consulted. This is not proof that exploitation never occurred.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.