# Recent security vulnerabilities in Hydra

**URL:** https://discourse.nixos.org/t/recent-security-vulnerabilities-in-hydra/80913
**Category:** Security
**Created:** [November 3, 2026, 5:19pm UTC](https://discourse.nixos.org/t/recent-security-vulnerabilities-in-hydra/80913 "2026-11-03T17:19:49Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Ericson2314](https://discourse.nixos.org/user_avatar/discourse.nixos.org/ericson2314/32/316_2.png) [@Ericson2314](https://discourse.nixos.org/u/Ericson2314)
#### Post date: [November 3, 2026, 5:19pm UTC](https://discourse.nixos.org/t/recent-security-vulnerabilities-in-hydra/80913/1 "2026-11-03T17:19:49Z")

</div>

- [Path traversal in `/log` endpoint: arbitrary file read under `$HYDRA_DATA` · Advisory · NixOS/hydra · GitHub](https://github.com/NixOS/hydra/security/advisories/GHSA-rqvm-hhh5-vrx7)
- [Stored XSS via the homepage links of projects/packages · Advisory · NixOS/hydra · GitHub](https://github.com/NixOS/hydra/security/advisories/GHSA-29gh-79jf-g8rh)

were disclosed today, with the migrations merged in

- Hydra: [Merge pull request #2032 from NixOS/xss-homepage-links · NixOS/hydra@12053f3 · GitHub](https://github.com/NixOS/hydra/commit/12053f31df077f9d1bbcb2c5907aaf2b69b52ff2)
- Lix’s Hydra: [https://git.lix.systems/lix-project/hydra/commit/b7b04cfe81764e6a5728c17d79d9826f1070a48d](https://git.lix.systems/lix-project/hydra/commit/b7b04cfe81764e6a5728c17d79d9826f1070a48d)
- Hydra in Nixpkgs bumped in [hydra: 0-unstable-2026-10-27 -\> 0-unstable-2026-11-03 by GaetanLepage · Pull Request #582719 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/pull/582719).

[hydra.nixos.org](http://hydra.nixos.org) was already hardened via a proxy server configuration change. A Lix deployment (I do not know what URL) was likewise already hardened. The CUDA team’s deployment at [hydra.nixos-cuda.org](http://hydra.nixos-cuda.org) was also hardened. This would be done by limiting the log endpoint to disallow `..` as a “store path”. Example nginx:

```auto
@hydra_log_dot vars_regexp {http.request.uri.path} ^/log/\.|(^|/)\.\.?(/|$)
handle @hydra_log_dot {
  respond
}

```

Hydra deployers should update and/or likewise update their proxy server configurations.

Thank you to [LeSuisse (Thomas Gerbet) · GitHub](https://github.com/lesuisse) for reporting the issues (I do not know Discourse handle), and for @ma27 and @glepage for joining me on call today to release everyone synchronously.

Happy integrating continuously, everyone!