Use of GET Request Method With Sensitive Query Strings in nginx-ui - #VU142597
Published: August 14, 2026
Vulnerability identifier: #VU142597
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-598
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and escalate privileges.
The vulnerability exists due to use of get request method with sensitive query strings in isTrustedNodeRequest() in internal/middleware/websocket_origin.go when authenticating cluster nodes over WebSocket using the node_secret query parameter. A remote user can read exposed nginx access logs through the log-reading API and extract the node secret to disclose sensitive information and escalate privileges.
The issue can lead to bypass of WebSocket authentication and origin checks, and the log access endpoints require only a valid user token without additional role-based restrictions.
Affected software
nginx-ui
Remediation
Install security update from vendor's website.
nginx-ui - update to 2.5.0