NixOS Hydra Continuous Integration Service Secret Exposure Vulnerability

A vulnerability in the NixOS Hydra Continuous Integration service allows untrusted non-flake Nix code to potentially access secrets available to the hydra user or group. This issue does not impact signing keys held by the hydra-queue-runner and hydra-www users.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, specifically secrets accessible by the hydra user or group.

Remediation

Users can migrate their inputs to flakes, which are evaluated purely. Additionally, Hydra has been updated to version 2.28.1, which restores the 'restricted-eval' option, allowing for safer evaluations.