Key points
- CVE-2026-107813 is a high-severity flaw (CVSS 8.8) in Nginx UI versions 2.0.0 through 2.5.0.
- The vulnerability stems from an incomplete patch for a previous issue, leaving cluster operations unprotected by OTP step-up.
- Attackers with valid JWTs can manipulate nodes, credentials, and restart services without fresh second-factor verification.
Nginx UI, a web interface for the Nginx web server, contains a high-severity authentication bypass affecting cluster management operations. This flaw allows authenticated users with persistent or stolen JSON Web Tokens to perform sensitive actions without providing a fresh one-time password.
What happened
According to the National Vulnerability Database, CVE-2026-107813 affects Nginx UI versions from 2.0.0 up to, but not including, 2.5.0. The issue is classified as high severity with a CVSS score of 8.8 and is linked to CWE-862, which concerns incorrect category changes. The vulnerability arises because the `api/cluster` router exposes node and namespace mutation operations, as well as cluster-wide reload and restart commands, with basic authentication (`AuthRequired`) but without requiring a secure session (`RequireSecureSession`).
This defect is identified as an incomplete fix for the earlier vulnerability CVE-2026-84315. According to the GitHub advisory GHSA-h246-wpgf-vmq5, the previous patch applied secure-session middleware to mutation routers for nginx, certificates, DNS, backups, sites, and streams. However, the physically separate `api/cluster` package was overlooked. Consequently, operations such as adding, editing, or deleting nodes, reading or replacing node credentials, modifying namespaces, and invoking `nodes/reload_nginx` or `nodes/restart_nginx` remain accessible to any user possessing a valid JWT. An attacker does not need a fresh second-factor step-up to execute these commands.
Why it matters
For security operations teams, this flaw undermines the principle of least privilege and multi-factor authentication within the Nginx UI ecosystem. An adversary who compromises a user’s session token can gain significant control over the infrastructure. They can alter cluster topology, extract sensitive node credentials, and force service interruptions by restarting Nginx across the cluster.
This capability is particularly dangerous in environments where Nginx UI manages critical web infrastructure, as it allows for potential denial-of-service conditions or further lateral movement through credential theft. The fact that this is an incomplete remediation of a known issue suggests that other administrative endpoints may also require review for consistent security controls.
What happens next
Organisations should verify their Nginx UI versions immediately. According to the source material, the issue is fixed in version 2.5.0. Users running affected versions should plan to upgrade as soon as possible. Until the update is deployed, teams should monitor logs for unauthorized cluster modifications or unexpected reload events.
What to do and how to stay safe: Nginx UI
- Audit Nginx UI installations to confirm whether versions fall within the affected range of 2.0.0 to 2.5.0.
- Review access logs for the `api/cluster` endpoints to detect any unusual node creation, deletion, or credential access patterns.
- Implement network-level restrictions to limit access to the Nginx UI administrative interface to trusted IP ranges only.
- Monitor for unexpected service restarts or configuration changes that could indicate exploitation of the bypass.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Nginx UI are affected by CVE-2026-107813?
Versions from 2.0.0 up to, but not including, 2.5.0 are vulnerable to this authentication bypass.
Is there a patch available for this vulnerability?
Yes, the issue is fixed in version 2.5.0 of Nginx UI.
What actions can an attacker perform with this flaw?
An attacker with a valid JWT can perform node CRUD operations, read or replace node credentials, change namespaces, and trigger cluster-wide Nginx reloads or restarts without OTP step-up.
