CVE-2026-27944: Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
Vulnerability summary
CVE-2026-27944 is a critical (CVSS 9.8) vulnerability in 0xjacky nginx-ui. EPSS estimates a 22.84% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 05-03-2026PublishedVulnerability first disclosed.
- 19-03-2026Last modifiedVulnerability information updated.
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
22.84%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
Increase +21.83 pp
From 1.01% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNginx Ui
Maturity: poc
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
0xjacky1 product
- nginx-ui< 2.3.3
Github.com/0xJacky1 product
- Nginx-UI< 2.3.3 | All versions (No fix recorded)
Nginxui1 product
- nginx_ui< 2.3.3
3 vendors · 3 products
References
6 links- github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762X Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/0xJacky/nginx-uiPACKAGE