CVE-2026-107811 in Nginx UI
Summary
by MITRE • 10/09/2026
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within Nginx UI versions ranging from 2.0.0 to 2.5.0 represents a critical cross-node authentication bypass that stems from improper handling of node tokens during API response serialization. In this architecture, the application serves as a web-based management interface for the underlying Nginx web server infrastructure. The core technical flaw lies in the exposure of sensitive internal credentials through standard authenticated endpoints. Specifically, when an ordinary user with valid login credentials accesses the /api/nodes endpoint or its specific variant /api/nodes/:id, the API response includes serialized data that contains the node token field. This oversight allows any authenticated user to retrieve these tokens without requiring elevated privileges or administrative access, effectively leaking internal secrets intended for inter-service communication rather than end-user interaction.
The operational impact of this flaw is severe because it enables privilege escalation through credential reuse across different authentication contexts. The retrieved node token serves a dual purpose within the system's security model. While originally designed to authenticate trusted nodes during cluster synchronization and management tasks, the same token value is accepted by the AuthRequired middleware component under the X-Node-Secret header. When this header is presented with a valid token obtained from the API response, the authentication logic maps the request directly to the initUser function. This mechanism bypasses standard user-based access controls, allowing an attacker to impersonate a trusted node against any reachable cluster member. Consequently, the attacker gains the ability to execute sensitive management operations that are typically restricted to administrative or system-level processes.
This unauthorized capability exposes critical infrastructure functions to potential abuse by lower-privileged users. The most significant risks include configuration synchronization and service restarts. An attacker leveraging this vulnerability can manipulate the Nginx cluster's state, potentially pushing malicious configurations across multiple nodes to disrupt services or create backdoors. Furthermore, the ability to trigger service restarts can lead to denial of service conditions or be used as a vector for further exploitation during the brief window when services are restarting and may have reduced security checks active. This scenario aligns with CWE-284 Improper Access Control, as it involves bypassing intended restrictions on access to system resources by exploiting flawed authentication logic that conflates user identity with node trust relationships.
From a tactical perspective, this vulnerability facilitates lateral movement within the cluster environment and can be classified under ATT&CK technique T1078 Valid Accounts, specifically when used for impersonation of service accounts or nodes rather than just human users. It also relates to CWE-200 Information Exposure, as sensitive internal tokens are disclosed through standard API responses that should not contain such high-value secrets. The exploitation requires only basic authentication credentials, making it a low-barrier attack vector for any insider threat or compromised user account within the management network.
The issue was resolved in version 2.5.0 of Nginx UI by correcting the serialization logic to exclude sensitive node tokens from API responses intended for ordinary users. To mitigate this risk in affected environments, administrators should immediately upgrade to version 2.5.0 or later. For systems that cannot be updated instantly, network segmentation strategies can help limit exposure by restricting access to the Nginx UI management interface and ensuring that cluster communication channels are secured with additional layers of authentication such as mutual TLS. Additionally, implementing strict API response filtering policies during development can prevent similar information leakage in future versions, ensuring that internal secrets remain isolated from user-facing data structures.