Read the docs
TI-2026-30544 Aliases CVE-2026-42223GHSA-q4w7-56hr-83rm

nginx-ui: Settings API Exposes Protected Secrets

Priority MEDIUM 62CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag is only enforced during writes (via ProtectedFill in SaveSettings) and is completely ignored during reads. This exposes 40+ protected fields including JwtSecret (enabling auth token forgery), NodeSecret (enabling cluster node impersonation), OIDC ClientSecret (enabling OAuth account takeover), and the IP whitelist configuration. This issue has been patched in version 2.3.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nginx-ui (0xJacky): 2.3.8github.com/0xJacky/nginx-ui (Go): 2.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-uibefore 2.3.82.3.8Patch availableCNA
—github.com/0xJacky/nginx-ui (Go)before 2.3.82.3.8Patch availableGHSA-q4w7-56hr-83rm
  • nginx-ui Vendor0xJacky Affected before 2.3.8 Fixed in 2.3.8 Patch available CNA
  • github.com/0xJacky/nginx-ui (Go) Vendor— Affected before 2.3.8 Fixed in 2.3.8 Patch available GHSA-q4w7-56hr-83rm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*before 2.3.8Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions before 2.3.8 Vulnerable ·0xJacky

Remediation

  • Fix · CNA nginx-ui (0xJacky) Fixed in 2.3.8
  • Fix · GHSA-q4w7-56hr-83rm github.com/0xJacky/nginx-ui (Go) Fixed in 2.3.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42223
  2. 2026-10-03 Alias added: GHSA-q4w7-56hr-83rm

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-25472 nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVSS 4.0CRITICAL 9.4
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences