nginx-ui CVE-2026-42220

An attacker must first obtain valid credentials for any user account in nginx-ui (authenticated access required, as indicated by CVSS PR:L). Default installations of nginx-ui that create an init user account and allow additional user registration or federation are at higher risk. The vulnerability does not require any non-default configuration beyond basic nginx-ui deployment; the /api/settings endpoint and X-Node-Secret header authentication pathway are present and active in all affected versions. No special network conditions or protocol configurations are required - exploitation occurs over standard HTTPS/HTTP. The attack is limited by the requirement for initial user-level authentication; unauthenticated attackers cannot directly access /api/settings or retrieve node.secret without first compromising or being granted a user account.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-accessible vulnerability requiring low-privilege authentication with high confidentiality impact. The two-step attack-retrieving node.secret followed by header injection-requires neither user interaction nor elevated complexity, making this a practical privilege-escalation vector. However, the PR:L (Privilege Required) requirement means an attacker must first obtain any valid user account; this significantly limits real-world risk compared to unauthenticated information disclosure. The lack of integrity impact (I:N) means the attacker cannot directly modify Nginx configurations through this chain, though possession of the init user token likely grants such access through subsequent API calls outside this CVE's scope. The fact that this was patched in version 2.3.8 and is documented in a GitHub security advisory confirms vendor acknowledgment of the severity. No KEV status, EPSS score, or active exploitation data is provided; treat this as a confirmed but not yet widely exploited vulnerability. Organizations running nginx-ui in environments where regular user account compromise is plausible (e.g., development teams with shared credentials) face elevated risk.

An attacker with a low-privilege nginx-ui user account (e.g., obtained through credential stuffing or social engineering) authenticates and calls GET /api/settings, receiving the node.secret value in plaintext. The attacker then constructs a subsequent request to a sensitive API endpoint (such as one that modifies Nginx upstream servers or SSL certificates) and includes the stolen node.secret in the X-Node-Secret header. The AuthRequired() handler validates this header against the hardcoded shared secret, treating the request as coming from a trusted node and associating it with the init administrative user, thereby bypassing normal access controls.