What is the CVSS score of CVE-2026-42220?

CVE-2026-42220 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-42220?

Yes, a public proof-of-concept exploit is available for CVE-2026-42220. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-42220?

Yes, a patch is available for CVE-2026-42220. Update the affected software to the latest version immediately.

nginx-ui CVE-2026-42220

EUVD-2026-27133 MEDIUM

Information Exposure (CWE-200)

2026-05-04 GitHub_M

GHSA-7jrr-xw9c-mj39

Information Disclosure Nginx

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 04, 2026 - 22:17 EUVD

Analysis Generated

May 04, 2026 - 21:00 vuln.today

DescriptionGitHub Advisory

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.

AnalysisAI

nginx-ui prior to version 2.3.8 exposes sensitive configuration values including node.secret via an authenticated GET /api/settings endpoint, allowing an authenticated user to retrieve the shared authentication secret and subsequently impersonate the init administrative user by sending requests with the stolen node.secret via the X-Node-Secret header or node_secret query parameter. This enables privilege escalation and full administrative access to the Nginx configuration interface without additional authentication.

Technical ContextAI

nginx-ui is a web-based administration interface for Nginx that implements authentication via a trusted-node mechanism. The application stores a shared secret (node.secret) used for inter-node communication and bootstrapping. The vulnerability stems from two related weaknesses: first, the /api/settings endpoint fails to restrict access to sensitive parameters despite the user being authenticated at a lower privilege level; second, the AuthRequired() authentication handler accepts the same node.secret value through the X-Node-Secret HTTP header or node_secret query parameter without distinguishing between legitimate inter-node communication and user-supplied values. This conflates two authentication pathways-user authentication and trusted-node authentication-allowing credential leakage to become privilege escalation. The root cause is CWE-200 (Information Exposure) combined with improper use of a shared secret in a multi-tier authentication model.

RemediationAI

Upgrade nginx-ui to version 2.3.8 or later immediately; this is the vendor-released patch that addresses the information disclosure and credential leakage. The fix modifies the /api/settings endpoint to redact sensitive values (including node.secret) from responses to authenticated users, and separately strengthens the AuthRequired() handler to prevent user-supplied node_secret parameters from being accepted as equivalent to legitimate inter-node communication. If immediate upgrade is not feasible, implement network-level controls to restrict access to the /api/settings endpoint to trusted administrative networks only, and disable or restrict the X-Node-Secret header and node_secret query parameter acceptance at a reverse proxy layer (e.g., nginx upstream, WAF rule) - however, this workaround does not fully mitigate the information disclosure and should not be relied upon long-term. Audit logs for any calls to /api/settings by low-privilege accounts prior to the upgrade; if node.secret has been exposed, rotate it and review administrative session tokens for signs of misuse.