SB20260814129 - Multiple vulnerabilities in nginx-ui

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260814129

SB20260814129 - Multiple vulnerabilities in nginx-ui

Published: August 14, 2026

Security Bulletin ID SB20260814129
CSH Severity
High
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 19% Medium 63% Low 19%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 vulnerabilities.


1) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper access control in the AuthRequired() middleware when handling requests with a valid X-Node-Secret header or node_secret query parameter. A remote attacker can send a specially crafted request carrying the node secret to execute arbitrary code.

Requests authenticated in this way are processed as the initial administrator account, and the issue can be used to create an admin user and access the built-in web terminal.


2) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform cross-site request forgery against management APIs.

The vulnerability exists due to cross-site request forgery in the AuthRequired authentication middleware when handling cross-site state-changing requests from a logged-in administrator\'s browser. A remote attacker can induce the victim to submit a specially crafted request to perform cross-site request forgery against management APIs.

User interaction is required, and exploitation requires a logged-in administrator\'s browser to carry the token cookie. Accounts without OTP or Passkey, or endpoints that do not require secure-session proof, are affected.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass the secure-session requirement and perform sensitive cluster-wide administrative actions.

The vulnerability exists due to missing authorization in the api/cluster router when handling authenticated requests to cluster node, namespace, and cluster-wide reload/restart endpoints. A remote user can send requests with a valid JWT but without a fresh secure session to bypass the secure-session requirement and perform sensitive cluster-wide administrative actions.

The issue affects routes for node CRUD, namespace CRUD, and cluster-wide nginx reload and restart operations that were mounted with only AuthRequired and Proxy middleware.


4) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of symbolic links in the backup restore process when processing an attacker-supplied backup archive with Nginx restore enabled. A remote attacker can upload a specially crafted backup archive containing symlink entries to cause a denial of service.

Exploitation requires the restore operation to accept a correctly formatted encrypted backup archive and to run with restore_nginx=true.


5) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the /api/nodes and /api/nodes/:id cluster node endpoints when handling authenticated API requests. A remote user can request node list or detail responses to disclose sensitive information.

Exploitation requires a valid low-privileged user account and at least one configured cluster node.


6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass authentication and perform administrative actions on remote cluster nodes.

The vulnerability exists due to missing authorization in the node-secret authentication middleware when processing requests with a leaked X-Node-Secret header or node_secret query parameter. A remote user can send a request with a valid node secret to bypass authentication and perform administrative actions on remote cluster nodes.

The middleware maps requests with a matching node secret directly to initUser, enabling cross-node impersonation after obtaining a cluster node token.


7) Download of code without integrity check (CVE-ID: N/A)

CWE-ID: CWE-494 - Download of Code Without Integrity Check

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to download of code without integrity check in the self-upgrade mechanism when downloading and verifying release binaries and digest files from the same origin. A remote attacker can serve a malicious binary with a matching digest to execute arbitrary code.

User interaction is required to trigger the upgrade process, and exploitation may occur if the download source is compromised or if cleartext HTTP is used for the configured proxy.


8) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass two-factor authentication and gain full administrative access.

The vulnerability exists due to improper authentication in the password login endpoint and secure session enforcement when processing password-based login requests for passkey-only accounts. A remote attacker can authenticate with a compromised password without being required to complete a passkey assertion to bypass two-factor authentication and gain full administrative access.

Only accounts configured with a registered passkey and no TOTP secret are affected. The issue also impacts step-up checks for sensitive actions.


9) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the backup restore and nginx command execution functionality when restoring a forged encrypted backup and triggering nginx configuration testing. A remote attacker can upload a crafted backup that overwrites app.ini and then invoke the nginx test endpoint to execute arbitrary code.

The issue arises because the restore endpoint accepts attacker-supplied backup key material and restores protected application configuration that is normally not writable through the settings API.


10) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to improper neutralization of special elements used in an os command in the backup restore handler and settings-driven command execution sinks when restoring a crafted backup containing attacker-controlled app.ini settings. A remote user can upload a crafted backup file to overwrite command execution settings and execute arbitrary commands.

The logrotate command sink may be triggered automatically by the scheduled interval, enabling persistent execution without further user interaction. The issue can also be reached during the setup window through the restore endpoint that requires only the install secret.


11) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in an OS command in the /api/restore restore flow and nginx reload command handling when restoring a crafted backup and triggering a reload. A remote privileged user can overwrite the app.ini configuration with an attacker-controlled ReloadCmd and trigger /api/nginx/reload to execute arbitrary code.

The issue is reachable because the secure-session check early-returns for users without TOTP enrolled, and exploitation can persist across container restart.


12) Use of GET Request Method With Sensitive Query Strings (CVE-ID: N/A)

CWE-ID: CWE-598 - Information Exposure Through Query Strings in GET Request

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and escalate privileges.

The vulnerability exists due to use of get request method with sensitive query strings in isTrustedNodeRequest() in internal/middleware/websocket_origin.go when authenticating cluster nodes over WebSocket using the node_secret query parameter. A remote user can read exposed nginx access logs through the log-reading API and extract the node secret to disclose sensitive information and escalate privileges.

The issue can lead to bypass of WebSocket authentication and origin checks, and the log access endpoints require only a valid user token without additional role-based restrictions.


13) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify the live Nginx configuration path.

The vulnerability exists due to improper link resolution before file access in the backup restore process when extracting crafted backup archives. A remote user can create and restore a crafted backup archive to modify the live Nginx configuration path.

The issue is triggered before the restore flags are applied, so files can be written into the live configuration tree even when both restore options are set to false.


14) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as root.

The vulnerability exists due to improper verification of cryptographic signature in the backup restore mechanism when processing a crafted backup bundle. A remote user can upload a crafted backup archive that overwrites app.ini and then access the /api/pty terminal endpoint to execute arbitrary code as root.

No administrator interaction is required beyond the attacker\'s own session. In the official Docker image, the spawned shell runs with root privileges.


15) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary OS commands.

The vulnerability exists due to improper access control in the POST /api/restore endpoint and backup restore flow when restoring a crafted backup file. A remote privileged user can upload a crafted backup that overwrites app.ini and then trigger nginx control functionality to execute arbitrary OS commands.

The issue bypasses protected settings controls by writing configuration directly to disk, and the restored application configuration is loaded after an automatic restart.


16) Use of GET Request Method With Sensitive Query Strings (CVE-ID: N/A)

CWE-ID: CWE-598 - Information Exposure Through Query Strings in GET Request

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain full administrative access and disclose sensitive information.

The vulnerability exists due to use of GET request method with sensitive query strings in internal/middleware/middleware.go, internal/middleware/websocket_origin.go, and cluster configuration handling when processing node_secret authentication in URL query parameters. A remote user can read exposed node secrets from logs, referer headers, environment variables, or configuration files to obtain full administrative access and disclose sensitive information.

The exposed Node.Secret bypasses JWT validation, session checks, and 2FA for authenticated HTTP and WebSocket endpoints, and the secret may also be stored in plaintext in the nodes table.


Remediation

Install update from vendor's website.

References