nginx-ui CVE-2026-42223

Exploitation requires an authenticated user account with access to the nginx-ui web interface and ability to call the GetSettings API endpoint. No special configuration or feature enablement is required - the vulnerability exists in the default API implementation. Authentication is enforced by nginx-ui's existing auth layer (reflected in CVSS PR:L), meaning unauthenticated remote attackers cannot directly trigger the leak. However, any authenticated user - including read-only operator accounts, test accounts, or compromised low-privilege accounts - can extract all secrets. The vulnerability is present in the default installation without requiring non-standard deployment or configuration choices.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-accessible exploitation requiring low privileges (authenticated user) with high confidentiality impact. The Low complexity and no user interaction requirement reflect straightforward API access. EPSS data is not provided. No KEV status or POC availability is confirmed in input data. Real-world risk is elevated despite moderate CVSS score because: (1) authenticated users are common in many deployments (operators, DevOps teams, delegated admins); (2) exposed secrets (JwtSecret, NodeSecret, ClientSecret) enable lateral movement and account compromise, not just information disclosure - impact scope extends beyond the initial API response; (3) IP whitelist exposure aids reconnaissance for access control bypass. The lack of integrity impact reflects that this is read-only, but the secrets exposed have write-equivalent consequences when reused. SSVC considerations: exploitation is straightforward (AC:L), technical impact is total (secrets compromise), and the mission essential status depends on deployment context (mission-critical clusters vs. test environments).

An authenticated operator with read-only dashboard access (common for junior DevOps staff) calls the GetSettings API endpoint. The API returns all configuration in JSON, including JwtSecret and OIDC ClientSecret. The attacker uses the leaked JwtSecret to forge authentication tokens and gain admin access to nginx-ui, or uses ClientSecret to initiate OAuth token refresh attacks against the upstream identity provider, enabling account takeover of other authenticated users.