CVE-2026-107811

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x

Description Ordinary authenticated users can access the /api/nodes and /api/nodes/:id endpoints, which return node objects containing a sensitive token field. This token is used as a shared credential for node-to-node authentication. An attacker can use this leaked token in the X-Node-Secret header or the node secret query parameter to bypass normal authentication and impersonate a trusted node as an initUser. This allows the attacker to perform sensitive management operations on reachable cluster members, such as configuration synchronization and service restarts via the /api/system/restart endpoint.

Recommendations Update Nginx UI to version 2.5.0. As a temporary workaround, restrict access to the /api/nodes and /api/nodes/:id endpoints to prevent the exposure of node tokens.