Most recent entries from all

bdu:2026-06342

2026-10-04T00:06:29.884147+00:00

bdu:2026-06342

EUVD-2026-308662

2026-10-04T00:06:29.884183+00:00

EUVD-2026-308662

fkie_cve-2026-42220

2026-10-04T00:06:29.884198+00:00

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.

GHSA-7jrr-xw9c-mj39 — Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup e…

2026-10-04T00:06:29.884230+00:00

Affected: Go: github.com/0xJacky/Nginx-UI

## Summary An authenticated user can call `GET /api/settings` and retrieve sensitive configuration values, including `node.secret`. The same `node.secret` is accepted by `AuthRequired()` through the `X-Node-Secret` header (or `node_secret` query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. In my local reproduction on `v2.3.6`, `GET /api/settings` also returned `app.jwt_secret`. After extracting `node.secret`, I was able to access `GET /api/backup` using only `X-Node-Secret`, download a full backup archive, and obtain the `X-Backup-Security` response header containing the backup decryption material (`AESKey:AESIv`). I also confirmed that the disclosed `node.secret` is sufficient to reach the restore workflow on an installed instance. Using only `X-Node-Secret`, a valid backup archive, and its matching `X-Backup-Security` token, I successfully invoked `POST /api/restore`. In a follow-up rollback test, I changed `node.name` to `rollback-poc-B`, then restored a previously captured backup and observed the value revert to its original state. This extends the issue beyond secret disclosure and backup exfiltration into confirmed integrity impact through restore-based rollback of nginx-ui state/configuration. This breaks the trust boundary between ordinary user-authenticated API access and the internal node-authentication mechanism, and results in sensitive configuration disclosure, alternate-authenticatio…

WID-SEC-W-2026-1276 — nginx-ui: Mehrere Schwachstellen

2026-10-04T00:06:29.884398+00:00

Ein Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um beliebigen Code mit Root-Rechten auszuführen, sich Administratorrechte zu verschaffen und die vollständige Kontrolle über das System zu erlangen oder vertrauliche Informationen offenzulegen.