Nginx UI EUVD-2026-95895

Exploitation requires (1) a valid authenticated Nginx UI account with only ordinary (non-admin) privileges - consistent with CVSS PR:L; (2) a multi-node cluster configuration where at least one trusted peer is network-reachable, since the leaked node token is only useful when replayed as X-Node-Secret against another cluster member; and (3) a vulnerable version in the 2.0.0-2.4.x range where /api/nodes and /api/nodes/:id serialize the token field. Standalone single-node deployments and installations upgraded to 2.5.0 are not exploitable. The limiting factors are the mandatory authenticated account and the cluster-topology dependency; there is no mitigating user interaction or admin-privilege requirement, so any ordinary user in a clustered deployment qualifies.

This is a genuine priority, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) is internally consistent with the description: a network-reachable API (/api/nodes, /api/nodes/:id) exploitable with low complexity by any authenticated user holding ordinary (non-admin) privileges and no user interaction - matching PR:L and the phrase 'ordinary authenticated users.' The triple-high impact (C:H/I:H/A:H) is well justified because the leaked node token enables cross-node impersonation leading to configuration synchronization (integrity) and service restart (availability) on cluster peers, with the token disclosure itself being the confidentiality loss. No EPSS score, KEV listing, or SSVC decision data was provided, so automatability and widespread-exploitation probability cannot be quantified from the input. The only exploitation-relevant artifact is the vendor fix commit (a patch, NOT a proof-of-concept), so there is no confirmed public exploit. The main factor reducing real-world urgency is the prerequisite of a valid low-privileged account AND an active multi-node cluster deployment - single-node installations are not exposed. Net: a serious privilege-escalation/lateral-movement flaw in clustered deployments, but gated behind authentication and a specific topology.

A low-privileged but authenticated user of a clustered Nginx UI deployment calls GET /api/nodes (or /api/nodes/:id), reads the serialized node token from the JSON response, and replays it as the X-Node-Secret header to a reachable cluster member. Accepted by AuthRequired and mapped to initUser, the attacker now acts as a trusted node and can push configuration changes or restart services on peers. No public exploit is identified at time of analysis; only the vendor patch commit is available.