CVE-2026-107807: Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Vulnerability summary

CVE-2026-107807 is a high (CVSS 8.8) vulnerability in 0xjacky nginx-ui. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 22.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-10-2026
   PublishedVulnerability first disclosed.
2. 09-10-2026
   Last modifiedVulnerability information updated.

Description

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.

• CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
• CWE-598Use of HTTP Request With Sensitive Query StringThe web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.