github.com/0xjacky/nginx-ui

Vulnerabilities (20)

• CVE-2026-44015HigMay 12, 2026
  affected <= 2.3.4

  Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Prox

• CVE-2026-42238CriMay 4, 2026
  affected < 2.3.8fixed 2.3.8

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated rem

• CVE-2026-42223MedMay 4, 2026
  affected < 2.3.8fixed 2.3.8

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true"

• CVE-2026-42222HigMay 4, 2026

  Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.

• CVE-2026-42221HigMay 4, 2026
  affected >= 2.0.0, < 2.3.8fixed 2.3.8

  Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint

• CVE-2026-42220MedMay 4, 2026
  affected <= 1.9.9

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret hea

• CVE-2026-34403HigApr 20, 2026
  affected < 1.9.10-0.20260316053337-1a9cd29a3082fixed 1.9.10-0.20260316053337-1a9cd29a3082

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that au

• CVE-2026-33031HigApr 20, 2026
  affected < 1.9.10-0.20260314152518-7b66578adb47fixed 1.9.10-0.20260314152518-7b66578adb47

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s a

• CVE-2026-33026CriMar 30, 2026
  affected <= 1.9.9

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

• CVE-2026-33032CriMar 30, 2026
  affected <= 1.99

  Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware)

• CVE-2026-33030HigMar 30, 2026
  affected <= 1.99

  Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application'

• CVE-2026-33029MedMar 30, 2026
  affected <= 1.99

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval

• CVE-2026-33028HigMar 30, 2026
  affected <= 1.99

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corr

• CVE-2026-33027MedMar 30, 2026
  affected <= 1.99

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and exe

• CVE-2026-27944Mar 5, 2026
  affected < 2.3.3fixed 2.3.3

  Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticat

• CVE-2024-23828Jan 29, 2024
  affected < 2.0.0-beta.12fixed 2.0.0-beta.12

  Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024

• CVE-2024-23827Jan 29, 2024
  affected < 2.0.0-beta.12fixed 2.0.0-beta.12

  Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to

• CVE-2024-22198Jan 11, 2024
  affected < 2.0.0.beta.9fixed 2.0.0.beta.9

  Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Co

• CVE-2024-22196Jan 11, 2024
  affected < 2.0.0.beta.9fixed 2.0.0.beta.9

  Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query para

• CVE-2024-22197Jan 11, 2024
  affected < 2.0.0.beta.9fixed 2.0.0.beta.9

  Nginx-ui is online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also