CVE-2026-107813

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9

Description The api/cluster router fails to implement the RequireSecureSession middleware, which is intended to enforce a second-factor OTP (One-Time Password) step-up for sensitive operations. Consequently, an authenticated user with a stolen or persisted JWT (JSON Web Token) can bypass the secure session requirement to perform administrative actions without a fresh second-factor authentication. This allows the user to execute node CRUD operations, read or replace node credentials, modify namespaces, and trigger cluster-wide Nginx reload or restart operations.

Technical details include the following affected API endpoints:

Recommendations Update Nginx UI to version 2.5.0.