CVE-2026-107813 in Nginx UI
Summary
by MITRE • 10/09/2026
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The Nginx UI serves as a web-based management interface for the Nginx reverse proxy and load balancer, providing administrators with tools to configure routing rules, manage upstream servers, and monitor service health. Within versions ranging from 2.0.0 through 2.5.0, a critical authentication bypass vulnerability exists within the api/cluster router endpoint. This specific route exposes sensitive administrative operations including node creation, read, update, and deletion (CRUD), namespace mutation, credential management, and cluster-wide service control actions such as reloading or restarting Nginx configurations. While these endpoints are protected by an AuthRequired middleware that validates a JSON Web Token to confirm user identity, they fail to enforce the RequireSecureSession directive which is intended to mandate multi-factor authentication for high-privilege operations.
The technical flaw stems from an incomplete remediation of CVE-2026-84315, where developers addressed certain attack vectors but neglected to apply consistent security controls across all administrative endpoints. Specifically, the system does not verify whether a fresh second-factor step-up has occurred during the current session before allowing mutation operations on cluster nodes or configuration reloads. Consequently, an attacker who obtains a valid JWT through phishing, cross-site scripting, token leakage in logs or headers, or persistence via stored credentials can exploit this gap. The absence of re-authentication for sensitive actions means that possession of the initial authentication token is sufficient to escalate privileges and execute destructive commands without presenting the one-time password required by standard security policies.
The operational impact of this vulnerability is severe due to the high-privilege nature of the exposed functions. An authenticated attacker can manipulate cluster topology by adding or removing nodes, effectively disrupting load balancing capabilities or introducing malicious backend servers into the infrastructure. Furthermore, the ability to read or replace node credentials allows for lateral movement and potential compromise of other services connected via those credentials. The capability to change namespaces may lead to unauthorized access control changes or data isolation breaches. Most critically, invoking reload_nginx or restart_nginx operations can cause immediate service disruption leading to denial-of-service conditions, while also potentially allowing the execution of arbitrary code if configuration files are manipulated during the reload process to inject malicious directives into Nginx configurations.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the Common Weakness Enumeration framework. In terms of adversary behavior, it facilitates ATT&CK techniques including T1078 Valid Accounts where stolen credentials are used to maintain access, and T1499 Endpoint Denial of Service through service restarts or configuration reloads that disrupt availability. The failure to enforce step-up authentication for privileged actions also reflects weaknesses in session management practices outlined in OWASP guidelines regarding sensitive operations requiring re-verification.
To mitigate this risk, organizations must immediately upgrade Nginx UI to version 2.5.0 or later where the RequireSecureSession check is properly enforced on all cluster mutation and reload endpoints. In environments where upgrading is not instantly feasible, network-level controls should be implemented to restrict access to the management interface exclusively from trusted administrative IP ranges using firewalls or VPNs. Additionally, implementing strict JWT validation policies that include short expiration times and rotation mechanisms can reduce the window of opportunity for attackers utilizing stolen tokens. Security monitoring should also be enhanced to detect unusual patterns such as rapid successive configuration reloads or node modifications originating from a single session, which may indicate exploitation attempts against this vulnerability.