SB2026071787 - Multiple vulnerabilities in nginx-ui

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026071787

SB2026071787 - Multiple vulnerabilities in nginx-ui

Published: July 17, 2026

Security Bulletin ID SB2026071787
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Code Injection (CVE-ID: CVE-2026-42238)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the POST /api/restore endpoint when restoring a crafted backup archive during the unauthenticated installation window after process startup. A remote attacker can upload a crafted backup archive and trigger configuration testing to execute arbitrary code.

The issue is reachable only on fresh installations within 10 minutes of process startup, and the window reopens after each restart. Exploitation also requires the attacker to reach the service from an IP address not blocked by the IP whitelist.


2) Information disclosure (CVE-ID: CVE-2026-42220)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in the GET /api/settings endpoint when handling authenticated settings requests. A remote user can request the settings API and obtain sensitive configuration values, including node.secret, to disclose sensitive information.

The disclosed node.secret is accepted through the X-Node-Secret header or node_secret query parameter by the trusted-node authentication path and can be used to access backup and restore functionality, including obtaining backup decryption material and rolling back nginx-ui state on installed instances.


3) Missing Authentication for Critical Function (CVE-ID: CVE-2026-42221)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to claim the initial administrator account.

The vulnerability exists due to missing authentication for critical functionality in the /api/install installer endpoint when processing first-run installation requests on a fresh instance. A remote attacker can send a specially crafted installation request to claim the initial administrator account.

Exploitation is only possible before setup completes and within ten minutes of startup on an uninitialized instance.


4) Information disclosure (CVE-ID: CVE-2026-42223)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the GetSettings API handler when handling requests to retrieve application settings. A remote user can send a request to the /api/settings endpoint to disclose sensitive information.

Exposed data may include protected secrets such as JwtSecret, NodeSecret, OIDC ClientSecret, Casdoor ClientSecret, and IP whitelist configuration.


Remediation

Install update from vendor's website.

References