Use of GET Request Method With Sensitive Query Strings in nginx-ui - #VU142601
Published: August 14, 2026
Vulnerability details
The vulnerability allows a remote user to obtain full administrative access and disclose sensitive information.
The vulnerability exists due to use of GET request method with sensitive query strings in internal/middleware/middleware.go, internal/middleware/websocket_origin.go, and cluster configuration handling when processing node_secret authentication in URL query parameters. A remote user can read exposed node secrets from logs, referer headers, environment variables, or configuration files to obtain full administrative access and disclose sensitive information.
The exposed Node.Secret bypasses JWT validation, session checks, and 2FA for authenticated HTTP and WebSocket endpoints, and the secret may also be stored in plaintext in the nodes table.