Nginx UI CVE-2026-107807

Exploitation requires two concrete conditions. First, the Node.Secret must actually have been transmitted via the node_secret query parameter in an HTTP or WebSocket authentication request (the vulnerable path in versions 2.0.0-2.4.x that use node/cluster authentication) rather than via the X-Node-Secret header, so that it is written into a sink - access logs, reverse-proxy logs, browser history, Referer headers, configuration URLs, or deployment environment data. Second, the attacker must gain read access to one of those sinks to recover the plaintext secret. Limiting factors that reduce realistic risk: the feature must be in use (node clustering / Node.Secret auth), the secret must have been passed as a query parameter in practice, and the attacker needs access to a log/history source - none of which are guaranteed in a default single-node install. Once the secret is obtained, however, no further authentication, user interaction, or privilege is needed to gain admin API access.

The vendor CVSS of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this HIGH, and the impact is genuinely severe: possession of the Node.Secret master credential bypasses password, JWT, session, and second-factor checks for persistent administrative API access to configuration and secret material. However, the vendor vector arguably understates the complexity. The root issue (CWE-312) is that the credential is ACCEPTED via the node_secret query parameter, causing it to be recorded in access logs, proxy logs, browser history, Referer headers, config URLs, and deployment environment data. Actual exploitation therefore depends on an attacker first OBTAINING the leaked secret from one of those secondary sinks - a prerequisite the AC:L/PR:L rating does not fully capture, so the AC:L assignment is debatable (see assessed vector below). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Net: a real and high-impact credential-exposure/auth-bypass issue worth prioritizing wherever Nginx UI node clustering with Node.Secret auth is deployed, but current signals point to opportunistic/targeted risk (requires log or history access) rather than mass internet-wide exploitation. Verify the exact affected deployment mode with the GHSA advisory.

An administrator or cluster component authenticates to Nginx UI by passing the Node.Secret in the node_secret query parameter, which is then captured in reverse-proxy access logs, browser history, or a Referer header. An attacker with read access to any of those sinks extracts the plaintext secret and replays it against the HTTP or WebSocket authentication paths, bypassing password, JWT, session, and 2FA checks to obtain persistent administrative API access. No public exploit code was identified at time of analysis.