EUVD-2026-27140
GHSA-q4w7-56hr-83rm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag is only enforced during writes (via ProtectedFill in SaveSettings) and is completely ignored during reads. This exposes 40+ protected fields including JwtSecret (enabling auth token forgery), NodeSecret (enabling cluster node impersonation), OIDC ClientSecret (enabling OAuth account takeover), and the IP whitelist configuration. This issue has been patched in version 2.3.8.
AnalysisAI
nginx-ui versions prior to 2.3.8 expose 40+ protected configuration fields through the GetSettings API to authenticated users, including JwtSecret (auth token forgery), NodeSecret (cluster impersonation), and OIDC ClientSecret (OAuth takeover). The protected tag is enforced only during writes but completely ignored during reads, allowing authenticated attackers to extract sensitive secrets and IP whitelist configurations without requiring additional privileges or user interaction.
Technical ContextAI
nginx-ui is a web management interface for Nginx built in Go. The vulnerability exists in the GetSettings API handler (api/settings/settings.go:24-65) which serializes all settings structs to JSON. While sensitive fields are annotated with protected:true tags - intended to prevent unauthorized modification - the read operation in GetSettings bypasses this protection entirely. The ProtectedFill function enforces the tag only during SaveSettings (write operations), creating an asymmetric validation gap. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) classifies this as improper access control on sensitive data at rest within the application layer.
RemediationAI
Vendor-released patch: nginx-ui version 2.3.8. Upgrade immediately by pulling the v2.3.8 release tag or later from the nginx-ui repository and redeploying. If immediate upgrade is not feasible, apply network-level compensating controls: restrict API access to trusted internal networks only, implement reverse proxy authentication ahead of nginx-ui (e.g., WAF or API gateway), and rotate all exposed secrets (JwtSecret, NodeSecret, OIDC ClientSecret) after potential compromise is confirmed. Additionally, audit logs for GetSettings API calls to identify if unauthorized secret access occurred. Note that compensating controls do not remediate the underlying vulnerability; they only reduce exposure window. Patch application is mandatory.
Unauthenticated backup download and RCE in Nginx UI before 2.3.3. EPSS 1.0%. PoC available.
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 8.9), this vulnerability is remotel
Unauthenticated attackers can hijack the administrator account during nginx-ui's first-run installation window by claimi
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 7.7), this vulnerability is remotel
nginx-ui prior to version 2.3.8 exposes sensitive configuration values including node.secret via an authenticated GET /a
Nginx-UI is a web interface to manage Nginx configurations. Rated critical severity (CVSS 9.8), this vulnerability is re
Remote code execution as root in nginx-ui versions before 2.3.8 via unauthenticated backup restore within 10-minute star
Nginx-UI is a web interface to manage Nginx configurations. Rated high severity (CVSS 8.8), this vulnerability is remote
Disabled user accounts in Nginx UI versions before 2.3.4 retain full API access through previously issued JWT tokens for
Server-Side Request Forgery in Nginx UI (0xJacky/nginx-ui) version 2.3.4 and earlier lets any authenticated user coerce
Unauthenticated bootstrap takeover in nginx-ui 2.3.5 allows remote attackers to hijack the initial installation process
nginx-ui before version 2.3.5 allows Cross-Site WebSocket Hijacking (CSWSH) attacks due to improper WebSocket origin val
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today