Vulnerabilities

TI-2026-71334 CVE-2026-84312 · GHSA-44xr-mrhh-qm78

Login CSRF in Nginx UI Casdoor SSO callback

MEDIUM 64

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00172 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-287

TI-2026-71322 CVE-2026-84360 · GHSA-vc32-4gwf-77xp

OTP step-up bypass in Nginx UI MCP configuration tools

HIGH 68

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0042 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-288

TI-2026-71316 CVE-2026-84316 · GHSA-cf23-7qxj-xmhr

Nginx UI config validation bypass allows directive injection

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00507 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-184

TI-2026-71319 CVE-2026-84319 · GHSA-5r62-gj48-897x

Nginx UI MCP tools bypass restricted Nginx directive validation

LOW 36

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.0028 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-693

TI-2026-71317 CVE-2026-84317 · GHSA-76pm-mq2q-9gcr

Nginx UI MCP tool allows nginx directive injection

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00478 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-20

TI-2026-71313 CVE-2026-84313 · GHSA-gfrc-g87h-7h5w

Missing re-authentication in Nginx UI TOTP and passkey enrollment

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00542 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-287

TI-2026-71321 CVE-2026-84321 · GHSA-wq4w-vwvq-q3x9

Nginx UI short tokens survive revocation and authenticate again

MEDIUM 58

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0021 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-613

TI-2026-71314 CVE-2026-84314 · GHSA-2gc7-j998-5xx6

Account takeover in Nginx UI via missing secure session check

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00419 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-285

TI-2026-71320 CVE-2026-84320 · GHSA-jrq7-xrjx-pcfw

Path traversal in Nginx UI auto backup writes files outside storage

LOW 27

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00167 Published 2026-10-12 Fixed in 2.4.3, 1.9.10-0.20260715121709-f92218e01054 CWE-22

TI-2026-71318 CVE-2026-84318 · GHSA-9jww-cxg5-rj9m

Nginx UI MCP tool skips config validation, allowing authenticated RCE

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00816 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-693

TI-2026-71315 CVE-2026-84315 · GHSA-5v7c-xpfp-p65m

Nginx UI omits OTP step-up on sensitive mutation routes

HIGH 69

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00337 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-862

TI-2026-70040 CVE-2026-107813 · GHSA-h246-wpgf-vmq5

Missing authorization in Nginx UI cluster API skips OTP step-up

MEDIUM 40

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00305 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074433-a3999bd78a3b CWE-862

TI-2026-70039 CVE-2026-107812 · GHSA-662p-52hx-cmh2

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest →…

HIGH 68

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00175 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728114330-580585516dd8 CWE-494

TI-2026-70036 CVE-2026-107811 · GHSA-32gc-wf3m-78w9

Node token exposure in Nginx UI enables cross-node impersonation

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00435 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728091109-0ecbd106c37b CWE-200

TI-2026-70043 CVE-2026-107810 · GHSA-p8v3-89rh-jxc7

Nginx UI backup restore follows symlinks into live Nginx config

HIGH 68

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00445 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074146-a467ed652591 CWE-59

TI-2026-70037 CVE-2026-107809 · GHSA-33rr-wq23-g6gg

Cross-site request forgery in Nginx UI management APIs

LOW 39

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00226 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074433-a3999bd78a3b CWE-352

TI-2026-70038 CVE-2026-107808 · GHSA-45gv-9wjv-xh7p

Authentication bypass in Nginx UI lets password login skip passkey 2FA

HIGH 70

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00413 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074558-95cd21b70814 CWE-287

TI-2026-70044 CVE-2026-107807 · GHSA-pvgv-gcp7-v38g

Nginx UI exposes node secret in URL query parameter

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00296 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074433-a3999bd78a3b CWE-312

TI-2026-70057 CVE-2026-107806 · GHSA-p393-cf76-4jmr

Code injection in Nginx UI backup restore allows code execution

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00571 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074146-a467ed652591 CWE-94

TI-2026-70056 CVE-2026-107805 · GHSA-j3hg-9rp3-5hw9

Nginx UI lets unauthenticated clients exhaust temporary storage

LOW 39

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00468 Published 2026-10-09 Fixed in 2.6.0, 1.9.10-0.20260901043436-8c9b9a1aff21 CWE-400

TI-2026-70055 CVE-2026-107804 · GHSA-9h23-53f4-q947

Bundled reverse proxy in Nginx UI bypasses IP allowlists

LOW 29

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0022 Published 2026-10-09 Fixed in 2.6.0, 1.9.10-0.20260904075558-e30e331303fc CWE-346

TI-2026-32056 CVE-2026-44015 · GHSA-wr32-99hh-6f35

Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00318 Published 2026-05-12 No fix listed CWE-918

TI-2026-30559 CVE-2026-42238 · GHSA-4pvg-prr3-9cxr

Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

HIGH 74

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.0 Network No auth User interaction EPSS 0.00971 Published 2026-05-04 Fixed in 2.3.8 CWE-94

TI-2026-30544 CVE-2026-42223 · GHSA-q4w7-56hr-83rm

nginx-ui: Settings API Exposes Protected Secrets

MEDIUM 62

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00295 Published 2026-05-04 Fixed in 2.3.8 CWE-200

TI-2026-30543 CVE-2026-42222 · GHSA-mxqh-q9h6-v8pq

nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00339 Published 2026-05-04 No fix listed CWE-284

Vulnerabilities

Filters