CVE-2026-27944

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.3

Description Nginx UI contains a critical flaw where the /api/backup endpoint is accessible without authentication. When this endpoint is accessed via a GET request, the server provides a full system backup and discloses the AES-256 encryption keys (key and IV) required to decrypt the backup within the X-Backup-Security response header. This allows an unauthenticated remote attacker to download and immediately decrypt sensitive data, including user credentials, session tokens, SSL private keys, and Nginx configurations. The issue is rooted in the CreateBackup() function within api/backup/router.go and api/backup/backup.go, where authentication middleware is missing for the backup route. Approximately 500 active instances were identified in the RuNet segment, with 35% potentially affected.

Recommendations Update Nginx UI to version 2.3.3 or higher. Restrict network access to the Nginx UI management interface, ensuring it is not accessible from the public internet by using a VPN or an allowlist of trusted IP addresses. Implement additional authentication, such as HTTP Basic Authentication, at the reverse-proxy level. Rotate all sensitive secrets, including Nginx UI user passwords, SSL certificates, and session tokens. Monitor logs for unauthorized requests to the /api/backup endpoint or the presence of the X-Backup-Security header in responses.