Nginx Ui CVE-2026-34403

An administrator must be logged into nginx-ui (authenticated session with valid cookie) and must visit or be socially engineered into visiting an attacker-controlled webpage or malicious advertisement. The nginx-ui WebSocket endpoints must be network-accessible from the attacker's webpage (no firewall blocking between attacker's server and target); this is true for any internet-facing nginx-ui instance. No special configuration or non-default settings are required on the nginx-ui side - the vulnerability exists in all default deployments prior to v2.3.5. The attack does NOT require the administrator to click a button or perform any action beyond visiting the page; JavaScript runs automatically. Limiting factors include: (1) the administrator must be logged in (requires prior successful authentication), (2) the administrator must visit the attacker's page (social engineering required), (3) if the administrator uses an incognito/private browsing session or has restrictive cookie policies, some attacks may be mitigated.

CVSS 5.5 with AV:N/AC:L/UI:A reflects network-accessible attack requiring low complexity and user interaction (visiting attacker's webpage), with high confidentiality impact but no integrity or availability impact - consistent with information disclosure. EPSS data not provided; however, the attack requires an administrator to be logged in AND click a malicious link, which reduces real-world frequency compared to AV:N/AC:L/PR:N/UI:N attacks. KEV status not provided; no public exploit identified. The vulnerability is real but not an immediate critical priority: exploitation requires social engineering (tricking admin into visiting attacker's page), and the impact is limited to information disclosure via WebSocket rather than remote code execution. Organizations with strong security awareness training or restrictive browsing policies face lower risk. However, the combination of CSWSH plus cookie-based authentication without HttpOnly/SameSite is a clean security misconfiguration that warrants rapid patching to v2.3.5 for any exposed nginx-ui instances.

An attacker hosts a malicious webpage containing JavaScript that opens a WebSocket connection to a target nginx-ui instance (e.g., https://admin.company.com/api/ws). When a logged-in nginx-ui administrator visits the attacker's webpage, their browser automatically includes their nginx-ui authentication cookie in the WebSocket handshake due to the missing SameSite restrictions. The attacker's JavaScript receives the WebSocket connection and begins sending commands or querying configuration data through the authenticated channel, all without the administrator's knowledge or explicit consent.