CVE-2026-107809 in Nginx UI
Summary
by MITRE • 10/09/2026
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim's session. This issue is fixed in version 2.5.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
Nginx UI serves as a web-based administrative interface for managing Nginx web server configurations, providing users with a graphical means to modify settings and control service behavior. In versions ranging from 2.0.0 through 2.5.0, the authentication mechanism relies on storing JSON Web Tokens within browser-managed cookies after initial login. This architectural decision creates a significant security gap because it allows these tokens to be automatically included in cross-origin requests initiated by malicious third-party sites. The core technical flaw lies in the insufficient validation of request origins and the absence of anti-CSRF protections for critical management endpoints, such as POST /api/configs. By leveraging standard browser behavior where cookies are sent with every request to a matching domain, an attacker can craft a malicious webpage that triggers authenticated requests against the Nginx UI interface without requiring user interaction beyond visiting the page or clicking a link.
The operational impact of this vulnerability is severe for any deployment using affected versions, particularly those managing production web servers. A remote attacker who induces a logged-in administrator to visit a controlled site can execute state-changing actions on behalf of that authenticated session. This includes modifying Nginx configuration files, triggering service reloads which may cause temporary downtime or performance degradation, and invoking other management operations available within the application's scope. The attack does not require breaking encryption keys or bypassing multi-factor authentication if the targeted endpoint lacks secure-session proof requirements like OTP verification during state changes. Consequently, an attacker can effectively take control of the web server configuration, potentially redirecting traffic to malicious sites, exposing sensitive data through misconfigured access controls, or disrupting service availability by applying invalid configurations that cause Nginx to crash upon reload.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery as a flaw where an application fails to verify the origin of state-changing requests. Furthermore, it maps to MITRE ATT&CK technique T1078, specifically valid accounts used for lateral movement or persistence within infrastructure environments. The lack of Origin and Referer header validation represents a failure in implementing proper CSRF defenses, such as synchronizer tokens that are unique per session and validated server-side before processing any configuration changes. Organizations relying on Nginx UI must recognize that the convenience of cookie-based token storage does not negate the need for robust request integrity checks when handling administrative functions.
To mitigate this risk, administrators should immediately upgrade to version 2.5.0 or later where these authentication and validation mechanisms have been corrected. For environments unable to patch instantly due to operational constraints, implementing a reverse proxy layer that enforces strict Origin header checking can provide temporary relief by blocking requests from unauthorized domains before they reach the application logic. Additionally, ensuring that all state-changing endpoints require explicit user confirmation or secondary authentication factors like one-time passwords adds a critical layer of defense against automated CSRF attacks. Regular security audits should verify that no management interfaces rely solely on cookie-based session tokens without supplementary anti-CSRF measures to prevent unauthorized configuration modifications by remote adversaries.