Medium severity · published Feb 9, 2026
CVE-2026-25740
Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module
5.8
CVSS
0.2%
EPSS
No
On KEV
Description
captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and earlier, when programs.captive-browser is enabled, any user of the system can run arbitrary commands with the CAP_NET_RAW capability (binding to privileged ports, spoofing localhost traffic from privileged services...). This vulnerability is fixed in 25.11 and 26.05.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NI
nixpkgs · NixOS
<= 25.05 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25740
github.com
https://github.com/NixOS/nixpkgs/pull/487775
github.com
https://github.com/NixOS/nixpkgs/pull/487779
github.com
https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc
More from nixpkgs
9.1
CVE-2026-25137
NixOs Odoo database and filestore publicly accessible with default odoo configuration
8.7
CVE-2026-23838
Tandoor Recipes module allows SQLite database to be externally accessible with the default settings
8.5
CVE-2026-61828
nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`
5.3
CVE-2025-64766
NixOS has hardcoded credentials in Onlyoffice module