Key points
- CVE-2026-107811 affects Nginx UI versions 2.0.0 through 2.4.x
- Ordinary users can retrieve node tokens via exposed API endpoints
- The token allows impersonation of trusted nodes, bypassing normal auth
Nginx UI contains a high-severity authentication bypass that enables low-privileged users to assume the identity of trusted cluster nodes. The vulnerability, tracked as CVE-2026-107811, stems from improper handling of sensitive credentials within the application’s API responses.
What happened
Nginx UI is a web interface for managing Nginx web servers. According to the National Vulnerability Database (NVD) and a GitHub Security Advisory (GHSA-32gc-wf3m-78w9), the issue exists in versions from 2.0.0 up to, but not including, 2.5.0. The flaw involves a trust-boundary failure where ordinary authenticated users can access specific API endpoints that reveal sensitive authentication data.
Specifically, the endpoints `/api/nodes` and `/api/nodes/:id` are accessible to any user who has successfully logged in. These endpoints return node objects that include a `token` field. This token is not just an identifier; it is the same secret used for node-to-node authentication within the cluster. The application’s middleware is configured to accept this token in the `X-Node-Secret` header or query parameter. When the middleware receives a valid node secret, it bypasses standard user authentication and maps the request to an `initUser` context, effectively granting administrative privileges associated with a trusted node.
The root cause is twofold. First, the cluster router is mounted within a shared authenticated route group, allowing basic users to query node details. Second, the code serialises the node secret directly into the API response without redaction. As a result, a low-privileged user can extract the token and the target node’s URL, then use that token to impersonate a trusted node against other cluster members.
Why it matters
This vulnerability allows for cross-node administrative authentication bypass. By impersonating a trusted node, an attacker can perform sensitive management operations that should be restricted to administrators or system processes. According to the NVD record, these operations include configuration synchronisation and service restarts. This could lead to unauthorised changes to server configurations or service disruptions across the cluster. The issue is rated as high severity with a CVSS score of 8.8. It is classified under CWE-200 (Exposure of Sensitive Information) and CWE-862 (Authorization Issues).
What happens next
The vendor has released a fix for this issue. The vulnerability is resolved in Nginx UI version 2.5.0. Users running affected versions should update to this patched release to prevent unauthorised access to cluster management functions.
What to do and how to stay safe: Nginx UI
- Audit your Nginx UI version and update to 2.5.0 or later if you are running an affected release.
- Review API access logs for unusual requests to `/api/nodes` or `/api/nodes/:id` from low-privileged user accounts.
- Monitor cluster management APIs for unexpected configuration changes or service restarts initiated by non-administrative users.
- Ensure that node-to-node authentication secrets are rotated after patching, as any previously extracted tokens may still be valid until the secret is changed.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Nginx UI are affected by CVE-2026-107811?
Versions from 2.0.0 up to, but not including, 2.5.0 are vulnerable.
Can an unauthenticated user exploit this flaw?
No, the user must first be authenticated to access the API endpoints that expose the node token.
Is there a patch available for this vulnerability?
Yes, the issue is fixed in version 2.5.0.
