SB20261022374 - Multiple vulnerabilities in nginx-ui

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022374

SB20261022374 - Multiple vulnerabilities in nginx-ui

Published: October 22, 2026

Security Bulletin ID SB20261022374
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 45% Low 55%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass configuration directive restrictions and potentially execute arbitrary code.

The vulnerability exists due to improper input validation in internal/config/validation.go when processing configuration editor API requests for files with data extensions. A remote user can write blocked directives into evil.pem through /api/configs and reference that file from a .conf file using include evil.pem; to bypass directive validation and potentially execute arbitrary code when nginx loads the configuration.


2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create or overwrite files within the Nginx configuration tree, disrupt served sites, and potentially execute arbitrary code in Nginx workers.

The vulnerability exists due to improper input validation in the nginx-ui certificate synchronization endpoint when handling certificate synchronization requests. A remote user can send a crafted PUT /api/cert_sync request specifying file paths within the Nginx configuration tree and arbitrary certificate or key content to overwrite configuration files or private keys and trigger an unconditional reload without content validation or an nginx -t syntax check, potentially disrupting services or executing arbitrary code.

Code execution requires an Nginx image that includes the perl, njs, or lua module.


3) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to disclose internal HTTP response content through server-side request forgery without completing the required secure-session verification.

The vulnerability exists due to missing secure-session enforcement in the TestHealthCheck endpoint when processing health-check test requests containing user-controlled URLs. A remote user can submit a crafted request to POST /api/site_navigation/test_health_check/:id with a chosen target_url, method, headers, body, and expected_text to trigger server-side requests and infer response content through substring-match results.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to change persistent log-indexing settings, destroy existing search indexes, and degrade log-search availability without completing the required secure-session step-up.

The vulnerability exists due to missing authorization checks in the nginx-log advanced-indexing and index-rebuild routes when handling settings changes and rebuild requests. A remote user can send requests with a valid JWT but no fresh secure-session verification to POST /api/nginx_log/settings/advanced_indexing/enable, POST /api/nginx_log/settings/advanced_indexing/disable, or POST /api/nginx_log/index/rebuild to change indexing settings or trigger a destructive rebuild. A rebuild request with an empty body destroys all existing search indexes before reindexing, consuming CPU, I/O, and disk resources.

The actions can also reach child cluster nodes through the proxy functionality.


5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify the live nginx configuration without secure-session reauthentication and potentially cause a denial of service.

The vulnerability exists due to missing authorization checks in the nginx-ui self-check fix endpoint when handling configuration remediation requests. A remote user can send a POST request to /api/self_check/NginxConf-ConfD-Include/fix with a valid JWT but without a fresh X-Secure-Session-ID to rewrite nginx.conf with standard include directives, bypassing the interactive OTP or passkey step-up. The configuration parse-and-dump round-trip may corrupt existing configuration and cause the next reload to fail.

The same operation can reach child cluster nodes through Proxy() using the X-Node-ID header.


6) Authentication bypass using an alternate path or channel (CVE-ID: N/A)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass HTTP MCP authentication, disclose sensitive configuration information, and potentially modify nginx configuration through management tools.

The vulnerability exists due to improper authentication in the mcpAuthRequired() middleware in mcp/router.go when handling HTTP requests to POST /mcp and POST /mcp_message. A remote user can submit a valid 16-character WebSocket short token as an Authorization: Bearer credential to invoke MCP management tools outside the token's intended WebSocket scope.


7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to restart the nginx-ui service without completing the required OTP secure-session step-up.

The vulnerability exists due to missing authorization in the system/restart route in api/system/router.go when handling service restart requests. A remote user can submit a restart request using a valid JWT without a fresh secure session to restart the service and interrupt its availability.

The restart route rejects requests in the public demo deployment.


8) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to initiate a binary self-upgrade without completing the required OTP secure-session step-up.

The vulnerability exists due to missing authorization in the core-upgrade websocket route in api/system/router.go when handling upgrade requests. A remote user can access upgrade/perform using a valid JWT without a fresh secure session to invoke PerformCoreUpgrade and initiate a binary self-upgrade.

The core-upgrade websocket route rejects requests in demo mode.


9) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify upstream socket configuration without completing the required OTP secure-session step-up.

The vulnerability exists due to missing authorization in the upstream socket configuration route in api/upstream/router.go when handling configuration updates. A remote user can send a PUT request to /upstream/socket/:socket using a valid JWT without a fresh secure session to modify upstream socket configuration through UpdateSocketConfig.


10) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass secure-session step-up authentication to modify sensitive configuration, access management data, and disrupt NGINX services on a registered peer node.

The vulnerability exists due to missing authorization checks in the nginx-ui controller's node-proxy middleware when forwarding requests before route-specific secure-session checks execute. A remote user can add an X-Node-ID header identifying a registered peer to a request carrying a valid user JWT to invoke sensitive peer-node operations without fresh OTP or passkey verification, because the peer accepts the forwarded request as a trusted node principal.


11) Improper privilege management (CVE-ID: N/A)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges from a write-scoped service token to a persistent interactive administrator and gain complete control over the Nginx UI instance.

The vulnerability exists due to improper privilege management in the POST /api/restore endpoint when authorizing restore requests made with service tokens: the interactive-user denylist omits the endpoint, and write scope satisfies its secure-session check. A remote user can upload a crafted portable backup containing an enabled administrator account with a known password hash in database.db to replace the live user database and sign in as that administrator after the service restarts.


Remediation

Install update from vendor's website.

References