CVE-2026-107807

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.5.0

Description Nginx UI accepts the Node.Secret master credential via the node secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. This allows the credential to be exposed in plaintext within access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data such as app.ini and environment variables. An attacker who obtains this secret can bypass password, JWT, session, and second-factor authentication to gain persistent administrative API access. This access allows for reading TLS private keys, modifying Nginx configurations, and potentially achieving OS-level code execution. The issue is rooted in the getNodeSecret() function and the isTrustedNodeRequest() function, which both allow the node secret variable to be read from the URL query string.

Recommendations Update Nginx UI to version 2.5.0. As a temporary mitigation, avoid using the node secret parameter in URLs and ensure the X-Node-Secret header is used for authentication.