CVE-2026-107811: 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
Vulnerability summary
CVE-2026-107811 is a high (CVSS 8.8) vulnerability in 0xjacky nginx-ui. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 09-10-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNginx Ui
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
0xjacky1 product
- nginx-ui≥ 2.0.0, < 2.5.0
Github.com/0xJacky1 product
- Nginx-UI≥ 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b
Nginxui1 product
- nginx_ui≥ 2.0.0, < 2.5.0
3 vendors · 3 products
References
4 links- github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9X Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/0xJacky/nginx-uiPACKAGE