{"id":"CVE-2026-107811","published":"2026-10-09T16:17:25.690","lastModified":"2026-10-14T02:16:58.890","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-200","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9","tags":[]}],"exploitRefs":[{"url":"https://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9","tags":[]}],"hasPoc":true,"ai":{"summary":"Nginx UI allows authenticated users to access node management APIs that serialize node tokens, which can then be used to impersonate trusted nodes and bypass authentication for sensitive operations like configuration sync and service restarts.","exploitability":"Medium difficulty exploit requiring an authenticated user account with access to the affected APIs, leveraging the serialized node token to impersonate a trusted node within the cluster.","blast_radius":"Affects all Nginx UI installations between versions 2.0.0 and 2.5.0 where authenticated users can reach the /api/nodes endpoints, potentially exposing cluster-wide management operations to unauthorized access.","remediation":"Upgrade to version 2.5.0 or later to fix the authentication bypass vulnerability.","detection":"Monitor for unusual API access patterns to /api/nodes and /api/nodes/:id endpoints with elevated privilege requests, particularly when node tokens are used in X-Node-Secret headers during authentication attempts.","tags":["auth-bypass","web","api","node-management"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:51:53.664Z"}}