Skip to content0xjacky Nginx-ui vulnerabilities
- 0xjacky nginx-uiNginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)CVE-2026-84312Fix available7.1 High
- 0xjacky nginx-uiNginx UI: OTP secure-session step-up can be bypassed via MCP configuration toolsCVE-2026-84360Fix available8.1 High
- 0xjacky nginx-uiNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)CVE-2026-84316Fix available8.8 High
- 0xjacky nginx-uiNginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker contextCVE-2026-84319Fix available8.3 High
- 0xjacky nginx-uiNginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)CVE-2026-84317Fix available8.8 High
- 0xjacky nginx-uiNginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeoverCVE-2026-84313Fix available8.8 High
- 0xjacky nginx-uiNginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableCVE-2026-84321Fix available5.4 Medium
- 0xjacky nginx-uiNginx UI: Account Takeover via Missing `RequireSecureSession` on User Management EndpointCVE-2026-84314Fix available8.7 High
- 0xjacky nginx-uiNginx UI: Auto backup name allows path traversal outside validated storage pathCVE-2026-84320Fix available6.3 Medium
- 0xjacky nginx-uiNginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCECVE-2026-84318Fix available8.8 High
- 0xjacky nginx-uiNginx UI OTP secure-session step-up is missing on sensitive mutation routesCVE-2026-84315Fix available8.3 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-upCVE-2026-107813Fix available8.8 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMCVE-2026-107812Fix available7.5 High
- 0xjacky nginx-ui, nginxui nginx ui +1 more0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUserCVE-2026-107811Fix available8.8 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliedCVE-2026-107810Fix available8.1 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI AuthRequired token cookie fallback enables CSRF against management APIsCVE-2026-107809Fix available8.8 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)CVE-2026-107808Fix available8.1 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Node Secret Credential Exposure via URL Query ParameterCVE-2026-107807Fix available8.8 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwriteCVE-2026-107806Public exploitFix available9.4 Critical
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Unauthenticated signed-request body staging can exhaust temporary storageCVE-2026-107805Fix available7.5 High
- 0xjacky nginx-uiNginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutCVE-2026-107804Fix available5.3 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 moreUnauthenticated Remote Code Execution via Backup Restore in nginx-uiCVE-2026-42238Fix available9.0 Critical
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Settings API Exposes Protected SecretsCVE-2026-42223Fix available6.5 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeoverCVE-2026-422228.1 High
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimCVE-2026-42221Public exploitFix available8.1 High
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollbackCVE-2026-422206.5 Medium
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal ServicesCVE-2026-440158.5 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpointsCVE-2026-34403Fix available5.5 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI: Disabled users retain full API access through previously issued bearer tokensCVE-2026-33031Fix available8.6 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverCVE-2026-33032Public exploitEPSS 35.3%9.8 Critical
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Unencrypted Storage of DNS API Tokens and ACME Private KeysCVE-2026-330308.8 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: DoS via Negative Integer Input in Logrotate IntervalCVE-2026-330296.9 Medium
- 0xjacky nginx-ui, nginxui nginx ui, uozi cosy +2 moreNginx UI: Race Condition Leads to Persistent Data Corruption and Service CollapseCVE-2026-33028Fix available7.1 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration DirectoryCVE-2026-330276.9 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui Backup Restore Allows Tampering with Encrypted BackupsCVE-2026-33026Fix available9.4 Critical
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureCVE-2026-27944Public exploitFix availableEPSS 22.8%9.8 Critical
- nginxui nginx ui, 0xjacky nginx-ui +1 moreUnchecked logrotate settings lead to arbitrary command executionCVE-2024-49368Public exploitEPSS 27.7%8.9 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI's log path can be controlledCVE-2024-493675.5 Medium
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI's json field can construct a directory traversal payload, causing arbitrary files to be writtenCVE-2024-493667.7 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI authenticated RCE through injecting into the application config via CRLFCVE-2024-23828Fix available8.8 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI arbitrary file write through the Import Certificate featureCVE-2024-23827Fix available9.8 Critical
- 0xjacky nginx-ui, nginxui nginx ui +1 moreAuthenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)CVE-2024-22198Public exploitFix available7.1 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)CVE-2024-22197Fix available7.7 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreAuthenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)CVE-2024-22196Fix available7.0 High