CVE-2026-33030: Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys

Vulnerability summary

CVE-2026-33030 is a critical (CVSS 9.9) vulnerability in 0xjacky nginx-ui. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-03-2026
   PublishedVulnerability first disclosed.
2. 31-03-2026
   Last modifiedVulnerability information updated.

Description

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. At time of publication, there are no publicly available patches.

• CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.