CVE-2026-42220

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.8

Description An authenticated user can access the 'GET /api/settings' endpoint to retrieve sensitive configuration values, such as node.secret. This secret is accepted by the AuthRequired() function via the 'X-Node-Secret' header or the node secret query parameter, allowing requests to be treated as authenticated through the trusted-node path and associated with the init user.

Recommendations Update to version 2.3.8.