Missing Authorization in nginx-ui - #VU157114
Published: October 22, 2026
Vulnerability details
The vulnerability allows a remote user to modify the live nginx configuration without secure-session reauthentication and potentially cause a denial of service.
The vulnerability exists due to missing authorization checks in the nginx-ui self-check fix endpoint when handling configuration remediation requests. A remote user can send a POST request to /api/self_check/NginxConf-ConfD-Include/fix with a valid JWT but without a fresh X-Secure-Session-ID to rewrite nginx.conf with standard include directives, bypassing the interactive OTP or passkey step-up. The configuration parse-and-dump round-trip may corrupt existing configuration and cause the next reload to fail.
The same operation can reach child cluster nodes through Proxy() using the X-Node-ID header.