CVE-2026-107811: Nginx UI Authentication Bypass Vulnerability

CVE-2026-107811 Overview

Nginx UI is a web user interface for the Nginx web server. A cross-node authentication bypass affects versions 2.0.0 through 2.4.x, allowing any authenticated low-privilege user to impersonate a trusted cluster node. The /api/nodes and /api/nodes/:id endpoints serialize the node token field in their responses. That same token is accepted as the X-Node-Secret header by the AuthRequired middleware and maps the caller to initUser. An attacker who reads these endpoints can issue requests to any reachable cluster member as a trusted node, exposing configuration synchronization and service restart operations. The issue is fixed in version 2.5.0 and classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Any authenticated Nginx UI user can harvest node tokens, impersonate cluster peers, push arbitrary Nginx configuration, and trigger service restarts across the cluster.

Affected Products

Nginx UI versions 2.0.0 through 2.4.x
Any Nginx UI deployment operating in a multi-node cluster configuration
Fixed in Nginx UI 2.5.0

Discovery Timeline

2026-10-09 - CVE-2026-107811 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107811

Vulnerability Analysis

The flaw is a serialization-driven information disclosure that cascades into authentication bypass. The GET /api/nodes and GET /api/nodes/:id handlers return node objects whose JSON serialization includes the per-node token field. These endpoints enforce only standard authenticated-user authorization, not administrative scope. The AuthRequired middleware checks incoming requests for an X-Node-Secret header. When the header matches any registered node token, the middleware binds the request context to the synthetic initUser identity, which represents a trusted cluster peer. Combining these two behaviors lets a low-privilege user escalate laterally into node-to-node trust.

Root Cause

The root cause is dual: sensitive node credentials are included in API responses that lack administrative scoping, and the inter-node authentication path treats possession of a token as sufficient proof of node identity. There is no separation between the user-facing API surface and the cluster trust boundary, so leakage from one directly compromises the other.

Attack Vector

An authenticated attacker queries /api/nodes to enumerate peers and collect each returned token. The attacker then replays any token in the X-Node-Secret header to a cluster member, acquiring initUser privileges. From that identity, the attacker can invoke privileged cluster operations such as configuration synchronization and Nginx service restart, achieving configuration tampering and denial of service across the fleet.

// Patch excerpt: api/cluster/router.go
 }
 
 func InitRouter(r *gin.RouterGroup) {
+	r.POST("node/pair/upgrade", UpgradeLegacyPairing)
+
 	// Node
 	r.GET("nodes", GetNodeList)
 	nodeGroup := r.Group("nodes")
// Source: https://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512

The fix introduces an automated node credential lifecycle, including a legacy pairing upgrade route (node/pair/upgrade) and the removal of manually generated pairing codes from the UI, as seen in the companion change to app/src/views/node/Node.vue.

Detection Methods for CVE-2026-107811

Indicators of Compromise

Unexpected GET requests to /api/nodes or /api/nodes/:id originating from non-administrative user sessions.
Inbound HTTP requests carrying an X-Node-Secret header from source addresses outside the known cluster membership.
Unscheduled Nginx configuration synchronization events or service restarts across cluster members.
Audit log entries attributing privileged cluster actions to the initUser identity without a corresponding legitimate peer transaction.

Detection Strategies

Deploy reverse-proxy or WAF rules that log every request containing the X-Node-Secret header and alert when the source is not an allow-listed node IP.
Correlate /api/nodes reads with subsequent X-Node-Secret-authenticated requests from the same client within a short time window.
Baseline normal cluster synchronization frequency and alert on deviations consistent with abuse.

Monitoring Recommendations

Forward Nginx UI access logs and application audit logs to a centralized analytics platform for retention and correlation.
Monitor the parent processes of nginx -s reload or systemctl restart nginx for unexpected triggers.
Track user account creation and privilege changes within Nginx UI to detect follow-on persistence attempts.

How to Mitigate CVE-2026-107811

Immediate Actions Required

Upgrade all Nginx UI nodes to version 2.5.0 or later without delay.
After upgrading, rotate every existing node token and re-pair cluster members using the new credential lifecycle workflow.
Audit Nginx UI user accounts and revoke access for any user that should not have cluster visibility.
Review Nginx configuration history for unauthorized changes pushed through cluster synchronization.

Patch Information

The maintainers released the fix in Nginx UI 2.5.0. The patch adds an automated node credential lifecycle and introduces the node/pair/upgrade endpoint to migrate legacy pairings. See the GitHub Security Advisory GHSA-32gc-wf3m-78w9, the GitHub Release v2.5.0, and the remediation commit for details.

Workarounds

Restrict access to the Nginx UI management interface to trusted administrators only until the upgrade is applied.
Place the Nginx UI behind a reverse proxy that strips or validates the X-Node-Secret header on externally originated requests.
Enforce network segmentation so that cluster node-to-node traffic traverses an isolated management network inaccessible to end users.

bash

# Example: block external requests carrying X-Node-Secret at an upstream Nginx proxy
server {
    listen 443 ssl;
    server_name nginx-ui.example.com;

    location / {
        if ($http_x_node_secret) {
            return 403;
        }
        proxy_pass http://nginx_ui_backend;
    }
}