CVE-2026-104854

A flaw was found in Nx. The application creates communication endpoints (Unix domain sockets) for its background service and worker processes in shared temporary directories without proper access permissions or authentication. A local attacker sharing the same system can connect to these endpoints to achieve arbitrary code execution or access sensitive workspace data with the permissions of the user running Nx.

This issue affects the Nx build tooling daemon and plugin-worker Unix sockets. In Red Hat products where Nx appears in source manifests (including Grafana, Ansible Automation Platform UI components, and related offerings), Nx is used only as a build-time or development dependency and is not present or executed in the shipped product. Customers running the delivered packages or images are not exposed to this vulnerability. The services-management-platform javascript-clients component already includes a fixed Nx version.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.