Nginx UI EUVD-2026-95898

Requires Nginx UI 2.0.0 through 2.4.x deployed in clustered/multi-node mode and reachable on the network, with an attacker already holding a valid authenticated JWT - a legitimate low-privilege OTP-enabled account or a stolen/persisted token from a prior session. The specific flaw is that the api/cluster router enforces AuthRequired but omits RequireSecureSession, so sensitive node-mutation and nodes/reload_nginx|restart_nginx operations execute without a fresh second-factor step-up. Limiting factors: exploitation is impossible without an existing valid session token (no fully unauthenticated path), it only matters on instances that manage cluster nodes, and single-node deployments not using the cluster feature are not meaningfully exposed.

This is a genuine high-priority issue for the specific population that runs it, though not a mass-internet emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) rates it 8.8 and aligns well with the description: network-reachable cluster API, low complexity, and only low privileges required (PR:L), consistent with CWE-862 (Missing Authorization - specifically a missing second-factor step-up / RequireSecureSession check). The honest caveat is that PR:L understates a real prerequisite stated in the description: the attacker must already hold a valid authenticated JWT (a legitimate low-privilege account, or a stolen/persisted token). No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation - this is no public exploit identified at time of analysis. The source commit confirms the root cause and fix (nodeauth client, audit redaction of credentials, and secure-session gating of cluster node mutations). Signals are therefore internally consistent (CVSS high-impact matches a full node-takeover/reload primitive), but the absence of exploitation telemetry (EPSS/KEV/POC) means prioritization should be driven by whether you actually run Nginx UI in clustered mode, not by widespread-exploitation fear. Note this is explicitly an incomplete fix for CVE-2026-84315, so unpatched instances may believe they are already protected.

An attacker who has obtained any authenticated Nginx UI session token - a low-privilege account or a JWT stolen/persisted from a prior session - sends requests directly to the api/cluster endpoints. Because these routes require only AuthRequired and not RequireSecureSession, no fresh OTP step-up is demanded, so the attacker reads or replaces node credentials, alters namespaces, and triggers cluster-wide nginx reload/restart. No public exploit is reported, but the attack is a straightforward authenticated API call requiring no special tooling.