Which versions of Nginx are affected by CVE-2026-33031?

Nginx UI versions before 2.3.4 contain an authentication bypass vulnerability where disabled user accounts retain full API access through unexpired JWT tokens, allowing attackers with stolen…. A patch is available.

How to fix or mitigate CVE-2026-33031?

Within 24 hours: Inventory all Nginx UI deployments and document current versions; disable or revoke all existing JWT tokens via administrative interfaces if available, and audit access logs for suspicious API calls from disabled accounts. Within 7 days: Upgrade to Nginx UI version 2.3.4 or later; implement network-level API access restrictions to administrative APIs; conduct credential audit and force password resets for all administrative accounts. Within 30 days: Deploy token rotation policies with maximum JWT lifetime of 4 hours or less; implement secondary authentication (MFA) for administrative API access; establish monitoring for API calls from disabled user accounts.

Nginx CVE-2026-33031

Q: What is the CVSS score of CVE-2026-33031?

CVE-2026-33031 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23965 HIGH

Improper Access Control (CWE-284)

2026-04-20 GitHub_M

GHSA-x234-x5vq-cc2v

Authentication Bypass Nginx

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 22, 2026 - 17:33 nvd

Patch available

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Patch available

Apr 20, 2026 - 22:31 EUVD

Analysis Generated

Apr 20, 2026 - 21:44 vuln.today

CVSS changed

Apr 20, 2026 - 21:22 NVD

8.6 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 21:15 euvd

EUVD-2026-23965

Analysis Generated

Apr 20, 2026 - 21:15 vuln.today

CVE Published

Apr 20, 2026 - 20:12 nvd

HIGH 8.6

DescriptionGitHub Advisory

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources after the account is marked disabled. Since tokens can be used to create new accounts, it is possible the disabled user to maintain the privilege. Version 2.3.4 patches the issue.

AnalysisAI

Disabled user accounts in Nginx UI versions before 2.3.4 retain full API access through previously issued JWT tokens for the entire token lifetime, allowing attackers with stolen credentials to maintain persistent access and create new accounts even after administrative remediation attempts. This authentication bypass enables continued confidentiality and integrity compromise of Nginx configurations despite account lockout. Reported by GitHub security advisories; no evidence of active exploitation (not in CISA KEV), but the token-reuse mechanism makes exploitation straightforward for attackers who have already obtained credentials.

Technical ContextAI

Nginx UI (0xJacky/nginx-ui) is a web-based management interface for the Nginx web server, providing administrative functions through a REST API authenticated via JSON Web Tokens (JWT). The vulnerability stems from improper privilege management (CWE-284) where the token validation mechanism checks only token signature and expiration, failing to verify the current account status against the user database. When an administrator disables a user account, the authorization system does not invalidate existing tokens or cross-reference the disabled status during subsequent API requests. JWTs are stateless by design, meaning the token itself contains the authorization claims, and without server-side session tracking or token revocation lists, disabled accounts remain functionally active until token expiration. The CVSS:4.0 vector (AV:N/AC:L/PR:L/VC:H/VI:H) confirms network-accessible exploitation with low complexity requiring only low privileges (a previously authenticated user), resulting in high confidentiality and integrity impact to the vulnerable system.

RemediationAI

Upgrade Nginx UI to version 2.3.4 immediately, as documented in the GitHub security advisory GHSA-x234-x5vq-cc2v at https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-x234-x5vq-cc2v. The patched version implements proper token invalidation upon account disablement. After upgrading, force-expire all existing JWT tokens by rotating the signing secret in Nginx UI configuration, which immediately invalidates all previously issued tokens and requires users to reauthenticate. If immediate patching is not feasible, implement network-level access controls restricting Nginx UI API endpoints to trusted management networks only, and configure shortest practical token lifetime (reducing the window of post-disablement access). Monitor API access logs for activity from recently disabled accounts as an indicator of compromise. Note that network restrictions reduce attack surface but do not eliminate risk if attackers have already gained access to the management network. Token lifetime reduction trades operational convenience for reduced exposure window.