EUVD-2026-27133
GHSA-7jrr-xw9c-mj39
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.
AnalysisAI
nginx-ui prior to version 2.3.8 exposes sensitive configuration values including node.secret via an authenticated GET /api/settings endpoint, allowing an authenticated user to retrieve the shared authentication secret and subsequently impersonate the init administrative user by sending requests with the stolen node.secret via the X-Node-Secret header or node_secret query parameter. This enables privilege escalation and full administrative access to the Nginx configuration interface without additional authentication.
Technical ContextAI
nginx-ui is a web-based administration interface for Nginx that implements authentication via a trusted-node mechanism. The application stores a shared secret (node.secret) used for inter-node communication and bootstrapping. The vulnerability stems from two related weaknesses: first, the /api/settings endpoint fails to restrict access to sensitive parameters despite the user being authenticated at a lower privilege level; second, the AuthRequired() authentication handler accepts the same node.secret value through the X-Node-Secret HTTP header or node_secret query parameter without distinguishing between legitimate inter-node communication and user-supplied values. This conflates two authentication pathways-user authentication and trusted-node authentication-allowing credential leakage to become privilege escalation. The root cause is CWE-200 (Information Exposure) combined with improper use of a shared secret in a multi-tier authentication model.
RemediationAI
Upgrade nginx-ui to version 2.3.8 or later immediately; this is the vendor-released patch that addresses the information disclosure and credential leakage. The fix modifies the /api/settings endpoint to redact sensitive values (including node.secret) from responses to authenticated users, and separately strengthens the AuthRequired() handler to prevent user-supplied node_secret parameters from being accepted as equivalent to legitimate inter-node communication. If immediate upgrade is not feasible, implement network-level controls to restrict access to the /api/settings endpoint to trusted administrative networks only, and disable or restrict the X-Node-Secret header and node_secret query parameter acceptance at a reverse proxy layer (e.g., nginx upstream, WAF rule) - however, this workaround does not fully mitigate the information disclosure and should not be relied upon long-term. Audit logs for any calls to /api/settings by low-privilege accounts prior to the upgrade; if node.secret has been exposed, rotate it and review administrative session tokens for signs of misuse.
Unauthenticated backup download and RCE in Nginx UI before 2.3.3. EPSS 1.0%. PoC available.
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 8.9), this vulnerability is remotel
Unauthenticated attackers can hijack the administrator account during nginx-ui's first-run installation window by claimi
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 7.7), this vulnerability is remotel
Nginx-UI is a web interface to manage Nginx configurations. Rated critical severity (CVSS 9.8), this vulnerability is re
Remote code execution as root in nginx-ui versions before 2.3.8 via unauthenticated backup restore within 10-minute star
Nginx-UI is a web interface to manage Nginx configurations. Rated high severity (CVSS 8.8), this vulnerability is remote
Disabled user accounts in Nginx UI versions before 2.3.4 retain full API access through previously issued JWT tokens for
Server-Side Request Forgery in Nginx UI (0xJacky/nginx-ui) version 2.3.4 and earlier lets any authenticated user coerce
Unauthenticated bootstrap takeover in nginx-ui 2.3.5 allows remote attackers to hijack the initial installation process
nginx-ui versions prior to 2.3.8 expose 40+ protected configuration fields through the GetSettings API to authenticated
nginx-ui before version 2.3.5 allows Cross-Site WebSocket Hijacking (CSWSH) attacks due to improper WebSocket origin val
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today