Vulnerabilities

TI-2026-70040 CVE-2026-107813 · GHSA-h246-wpgf-vmq5

Missing authorization in Nginx UI cluster API skips OTP step-up

MEDIUM 40

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00305 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074433-a3999bd78a3b CWE-862

TI-2026-70039 CVE-2026-107812 · GHSA-662p-52hx-cmh2

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest →…

HIGH 68

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00175 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728114330-580585516dd8 CWE-494

TI-2026-70036 CVE-2026-107811 · GHSA-32gc-wf3m-78w9

Node token exposure in Nginx UI enables cross-node impersonation

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00435 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728091109-0ecbd106c37b CWE-200

TI-2026-70043 CVE-2026-107810 · GHSA-p8v3-89rh-jxc7

Nginx UI backup restore follows symlinks into live Nginx config

HIGH 68

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00445 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074146-a467ed652591 CWE-59

TI-2026-70037 CVE-2026-107809 · GHSA-33rr-wq23-g6gg

Cross-site request forgery in Nginx UI management APIs

LOW 39

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00226 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074433-a3999bd78a3b CWE-352

TI-2026-70038 CVE-2026-107808 · GHSA-45gv-9wjv-xh7p

Authentication bypass in Nginx UI lets password login skip passkey 2FA

HIGH 70

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00413 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074558-95cd21b70814 CWE-287

TI-2026-70044 CVE-2026-107807 · GHSA-pvgv-gcp7-v38g

Nginx UI exposes node secret in URL query parameter

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00296 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074433-a3999bd78a3b CWE-312

TI-2026-70057 CVE-2026-107806 · GHSA-p393-cf76-4jmr

Code injection in Nginx UI backup restore allows code execution

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00571 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074146-a467ed652591 CWE-94

TI-2026-70056 CVE-2026-107805 · GHSA-j3hg-9rp3-5hw9

Nginx UI lets unauthenticated clients exhaust temporary storage

LOW 39

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00468 Published 2026-10-09 Fixed in 2.6.0, 1.9.10-0.20260901043436-8c9b9a1aff21 CWE-400

TI-2026-32056 CVE-2026-44015 · GHSA-wr32-99hh-6f35

Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00318 Published 2026-05-12 No fix listed CWE-918

TI-2026-30559 CVE-2026-42238 · GHSA-4pvg-prr3-9cxr

Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

HIGH 74

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.0 Network No auth User interaction EPSS 0.00971 Published 2026-05-04 Fixed in 2.3.8 CWE-94

TI-2026-30544 CVE-2026-42223 · GHSA-q4w7-56hr-83rm

nginx-ui: Settings API Exposes Protected Secrets

MEDIUM 62

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00295 Published 2026-05-04 Fixed in 2.3.8 CWE-200

TI-2026-30543 CVE-2026-42222 · GHSA-mxqh-q9h6-v8pq

nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00339 Published 2026-05-04 No fix listed CWE-284

TI-2026-30542 CVE-2026-42221 · GHSA-h27v-ph7w-m9fp

nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01342 Published 2026-05-04 Fixed in 2.3.8 CWE-306

TI-2026-30541 CVE-2026-42220 · GHSA-7jrr-xw9c-mj39

Information disclosure in 0xJacky nginx-ui

MEDIUM 62

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00299 Published 2026-05-04 Fixed in 2.3.8 CWE-200

TI-2026-26688 CVE-2026-34403 · GHSA-78mf-482w-62qj

Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

MEDIUM 58

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0MEDIUM 5.5 Network No auth User interaction EPSS 0.00176 Published 2026-04-20 Fixed in 2.3.5, 1.9.10-0.20260316053337-1a9cd29a3082 CWE-1385

TI-2026-25477 CVE-2026-33031 · GHSA-x234-x5vq-cc2v

Nginx-UI: Disabled users retain full API access through previously issued bearer tokens

HIGH 72

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-20 Fixed in 2.3.4, 1.9.10-0.20260314152518-7b66578adb47 CWE-284

TI-2026-25472 CVE-2026-33026 · GHSA-fhh2-gg7w-gwpq

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00334 Published 2026-03-30 Fixed in 2.3.4, 1.9.10-0.20260315015203-f61bcec547c0 CWE-312

TI-2026-25473 CVE-2026-33027 · GHSA-m8p8-53vf-8357

Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory

HIGH 70

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00413 Published 2026-03-30 Fixed in 2.3.4 CWE-22

TI-2026-25474 CVE-2026-33028 · GHSA-m468-xcm6-fxg4

Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse

MEDIUM 64

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 7.1 Network High privileges No interaction EPSS 0.00554 Published 2026-03-30 Fixed in 2.3.4, 1.30.1 CWE-362

TI-2026-25475 CVE-2026-33029 · GHSA-cp8r-8jvw-v3qg

Nginx UI: DoS via Negative Integer Input in Logrotate Interval

MEDIUM 64

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00985 Published 2026-03-30 Fixed in 2.3.4 CWE-20

TI-2026-25476 CVE-2026-33030 · GHSA-5hf2-vhj6-gj9m

Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00285 Published 2026-03-30 No fix listed CWE-639

TI-2026-25478 CVE-2026-33032 · GHSA-h6c2-x2m2-mwhf

Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.35273 Published 2026-03-30 No fix listed CWE-306

TI-2026-22288 CVE-2026-27944 · GHSA-g9w5-qffc-6762

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.22842 Published 2026-03-05 Fixed in 2.3.3 CWE-306

TI-2024-32956 CVE-2024-49368

Unchecked logrotate settings lead to arbitrary command execution

HIGH 69

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.27668 Published 2024-10-21 Fixed in 2.0.0-beta.36 CWE-20

Vulnerabilities

Filters