Skip to content
OpenAdvisories
High WID-SEC-2026-2798 8 CVEs

NGINX-UI: Mehrere Schwachstellen

Published Aug 11, 2026 · Updated Oct 11, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in NGINX-UI ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code – auch mit Root-Rechten – auszuführen, Sicherheitsmaßnahmen zu umgehen, sensible Daten offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

nginx-ui ist eine Open-Source-Weboberfläche zur Verwaltung und Konfiguration von Nginx-Webservern.

Vulnerabilities 8

  • Critical 9.4
    CVE-2026-107806 Public exploit

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

    Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The resto…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.8
    CVE-2026-107807

    Nginx UI: Node Secret Credential Exposure via URL Query Parameter

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret hea…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.8
    CVE-2026-107809

    Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally requ…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.8
    CVE-2026-107811

    0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequir…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.8
    CVE-2026-107813

    Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.1
    CVE-2026-107808

    Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore is…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.1
    CVE-2026-107810

    Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 7.5
    CVE-2026-107812

    Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to …

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-107812, EUVD-2026-95897, CVE-2026-107813, EUVD-2026-95898, CVE-2026-107808, EUVD-2026-95891, CVE-2026-107807, EUVD-2026-95882, CVE-2026-107806, EUVD-2026-95822, CVE-2026-107811, EUVD-2026-95895, CVE-2026-107809, EUVD-2026-95892, CVE-2026-107810, EUVD-2026-95894

  2. #1

    Produkt angepasst

References