Skip to content
OpenAdvisories
High WID-SEC-2026-1188 2 CVEs

nginx-ui: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Published Apr 20, 2026 · Updated Apr 20, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um Sicherheitsvorkehrungen zu umgehen, wodurch weitere Angriffe ermöglicht werden.

Product

nginx-ui ist eine Open-Source-Weboberfläche zur Verwaltung und Konfiguration von Nginx-Webservern.

Vulnerabilities 2

  • High 8.6
    CVE-2026-33031

    Nginx-UI: Disabled users retain full API access through previously issued bearer tokens

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually te…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Medium 5.5
    CVE-2026-34403

    Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined …

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go

Revision history

  1. #1

    Initiale Fassung

References