CVE-2026-107806: Nginx UI Command Injection RCE Vulnerability

CVE-2026-107806 Overview

CVE-2026-107806 is a code injection vulnerability [CWE-94] in Nginx UI, a web user interface for the Nginx web server. The flaw affects versions 2.3.8 through 2.4.x and is fixed in version 2.5.0. An authenticated administrator can submit attacker-controlled portable backup key material and a matching manifest to the POST /api/restore endpoint. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Invoking POST /api/nginx/test then executes the attacker-controlled command in the Nginx UI runtime context.

Critical Impact
An authenticated administrator can achieve arbitrary command execution in the Nginx UI runtime context by abusing the backup restore trust boundary, compromising confidentiality, integrity, and availability.

Affected Products

Nginx UI versions 2.3.8 through 2.4.x
Nginx UI prior to version 2.5.0
Deployments exposing the /api/restore and /api/nginx/test endpoints to administrators

Discovery Timeline

2026-10-09 - CVE-2026-107806 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107806

Vulnerability Analysis

The vulnerability resides in the Nginx UI backup restore workflow. The portable backup format allows an administrator to supply a backup archive together with encryption key material and a manifest. Prior to version 2.5.0, the restore handler in api/backup/restore.go accepted the attacker-supplied key as authoritative and decrypted the archive contents without validating the trust boundary between the running instance and the imported backup.

Once decrypted, the restore routine overwrites the live app.ini configuration file. This file contains sensitive command settings used by the Nginx UI runtime, including TestConfigCmd, which defines the shell command executed when configuration tests are triggered. By controlling the backup contents, an attacker rewrites this command to an arbitrary shell payload. A subsequent request to POST /api/nginx/test executes the payload inside the Nginx UI process context.

Root Cause

The root cause is an improper trust boundary in the restore flow. The portable backup key was treated as sufficient proof of integrity, allowing an authenticated administrator to inject configuration values that should have been protected from external replacement. Protected settings such as nginx command fields were not isolated from backup-driven overwrites.

Attack Vector

Exploitation requires an authenticated administrator session. The attacker crafts a portable backup payload containing a modified app.ini where TestConfigCmd is replaced with an arbitrary command. The attacker uploads the archive and matching key to POST /api/restore, then issues POST /api/nginx/test to trigger execution. The command runs with the privileges of the Nginx UI service.

// Security patch in api/backup/restore.go - hardens backup restore trust boundaries
// RestoreResponse contains the response data for restore operation
type RestoreResponse struct {
-	NginxUIRestored bool `json:"nginx_ui_restored"`
-	NginxRestored   bool `json:"nginx_restored"`
-	HashMatch       bool `json:"hash_match"`
+	NginxUIRestored bool                 `json:"nginx_ui_restored"`
+	NginxRestored   bool                 `json:"nginx_restored"`
+	HashMatch       bool                 `json:"hash_match"`
+	TrustLevel      backup.ManifestTrust `json:"trust_level"`
+	SkippedSettings []string             `json:"skipped_protected_settings"`
}

func uploadedBackupPath(tempDir string) string {

Source: GitHub Commit a467ed6

The patch introduces a TrustLevel field and a SkippedSettings list, allowing the restore flow to classify incoming manifests and refuse to overwrite protected configuration keys.

Detection Methods for CVE-2026-107806

Indicators of Compromise

Unexpected POST /api/restore requests in Nginx UI access logs, especially from administrator sessions outside normal maintenance windows.
POST /api/nginx/test requests immediately following a restore operation.
Unexplained modifications to app.ini, particularly to the TestConfigCmd value or other nginx command settings.
Child processes spawned by the Nginx UI service that do not match the standard nginx -t test invocation.

Detection Strategies

Compare the running app.ini against a known-good baseline and alert on any drift to command-related fields.
Monitor process creation events on the host running Nginx UI for shell interpreters or non-standard binaries launched by the Nginx UI process.
Correlate HTTP request sequences that pair /api/restore with /api/nginx/test from the same session within a short time window.

Monitoring Recommendations

Enable verbose audit logging on all administrator-authenticated API calls to Nginx UI.
Forward web and process telemetry to a central analytics platform for long-term retention and sequence analysis.
Alert on new or modified administrator accounts, which can precede abuse of the restore endpoint.

How to Mitigate CVE-2026-107806

Immediate Actions Required

Upgrade Nginx UI to version 2.5.0 or later, which enforces trust boundaries during restore and skips protected settings.
Rotate all administrator credentials and session tokens on affected instances.
Audit app.ini on each instance and revert any unauthorized changes to TestConfigCmd and related nginx command fields.

Patch Information

The fix is released in Nginx UI v2.5.0 and tracked in GHSA-p393-cf76-4jmr. The patch commit a467ed6 hardens the restore flow by introducing a manifest trust level and invalidating portable credentials that cannot be safely re-encrypted under the destination instance key.

Workarounds

Restrict network access to the Nginx UI administrative interface using firewall rules or a reverse proxy allow list.
Enforce multi-factor authentication for all Nginx UI administrator accounts to raise the bar for session abuse.
Temporarily disable or block the /api/restore endpoint at the reverse proxy layer until the upgrade is deployed.

bash

# Example nginx reverse proxy snippet to block /api/restore until patching
location = /api/restore {
    return 403;
}

location = /api/nginx/test {
    allow 10.0.0.0/8;
    deny all;
}