Nginx UI Auth Bypass Lets Low-Priv Users Impersonate Trusted Cluster Nodes

The Nginx UI web interface contains a high-severity authentication bypass vulnerability that allows ordinary users to impersonate trusted cluster nodes. This flaw, tracked as CVE-2026-107811, exposes sensitive management operations and affects versions 2.0.0 through 2.5.0.

According to the GitHub advisory GHSA-32gc-wf3m-78w9, the issue stems from a trust-boundary failure where cluster node credentials are exposed to low-privileged users. The vulnerability is rated as high severity, with a CVSS score of 8.8, according to the National Vulnerability Database. The flaw involves weaknesses in information exposure (CWE-200) and improper authentication (CWE-862).

Context and Background

The root cause of the vulnerability is the exposure of sensitive credentials combined with improper trust elevation in node-to-node authentication. The source code analysis indicates that the cluster initialization router is mounted within the shared authenticated API route group. This configuration allows any successfully authenticated user to access the node list and detail endpoints.

When a user accesses the `/api/nodes` or `/api/nodes/:id` endpoints, the server returns node objects that include the `token` field. This token is serialized directly into the API response because the model definition includes the JSON tag `json:"token"` without redaction. Consequently, an attacker with a basic authenticated account can retrieve both the target node URL and the secret token used for trusted node authentication.

The second part of the exploit chain involves the middleware responsible for node-to-node authentication. The middleware accepts a node secret via the `X-Node-Secret` header or the `node_secret` query parameter. If the supplied value matches the system's node secret setting, the middleware associates the request with the `initUser` and bypasses the standard user-authentication path. This allows the attacker to impersonate a trusted node against a reachable cluster member.

Who Is Affected

The vulnerability affects the Nginx UI web user interface for the Nginx web server, developed by 0xJacky. Specifically, versions 2.0.0 through 2.5.0 are vulnerable. The GitHub advisory identifies the vulnerable Go package range as `github.com/0xJacky/Nginx-UI` versions greater than or equal to `1.9.10-0.20250517140552-daee3ac7ade1` and less than `1.9.10-0.20260728091109-0ecbd106c37b`.

The issue is patched in version `1.9.10-0.20260728091109-0ecbd106c37b`. For users of the standard release versions, the issue is fixed in version 2.5.0. The vulnerability allows for cross-node administrative authentication bypass, which can expose sensitive management operations including configuration synchronization and service restart.

What should you do?

Administrators using Nginx UI should verify their current version and update to 2.5.0 or the corresponding patched Go package version as soon as possible. Organizations should monitor network traffic for unusual authentication patterns involving node-to-node communication. Reviewing access logs for requests to the `/api/nodes` endpoint may help identify potential exploitation attempts.