Nginx UI cluster operations bypass OTP step-up in incomplete CVE-2026-107813 fix

Nginx UI, a web user interface for the Nginx web server, contains a high-severity authentication bypass vulnerability that allows authorized users to perform sensitive cluster operations without providing a fresh second-factor code. The National Vulnerability Database assigned CVE-2026-107813 to the flaw, rating it 8.8 on the Common Vulnerability Scoring System.

The vulnerability stems from an incomplete remediation of a previous security issue, CVE-2026-84315. According to the GitHub Security Advisory GHSA-h246-wpgf-vmq5, the vendor added a secure-session requirement to several mutation routers, including those for nginx, cert, dns, backup, site, and stream management.

This requirement forced users to provide a One-Time Password (OTP) step-up beyond their standard JSON Web Token (JWT) to perform sensitive actions. However, the parallel api/cluster router was not updated to include this middleware. As a result, operations within the cluster module, such as adding, editing, or deleting nodes, and changing namespaces, run with only the base JWT authentication.

Context and Background

The defect allows an attacker who possesses a stolen or persisted JWT to perform critical cluster management tasks without triggering the additional security check. According to the advisory, an authenticated user whose JWT is compromised can read or replace node credentials, modify namespaces, and invoke cluster-wide Nginx reload or restart commands. This occurs because the api/cluster package registers these sensitive operations on the bare authenticated group, whereas the fixed sibling routers wrap their handlers in middleware.RequireSecureSession(). The issue was confirmed at commit 2cb7ee9102c9d87274de2fa104db804841d140a0.

The weakness is categorized under CWE-862, which relates to improper verification of data authenticity. While the vendor addressed the requirement for secure sessions in other parts of the application, the oversight in the cluster router left a significant gap in the defense-in-depth strategy for multi-node deployments.

Who is affected

Organizations using Nginx UI version 2.0.0 up to, but not including, version 2.5.0 are affected by this vulnerability. The GitHub advisory also identifies vulnerable Go module versions, specifically those greater than or equal to 1.9.10-0.20250517140552-daee3ac7ade1 and less than 1.9.10-0.20260728074433-a3999bd78a3b. The vendor has released a fix in version 2.5.0, which applies the missing secure-session requirement to the cluster router.

What should you do?

Administrators should verify their current Nginx UI version and compare it against the affected range. If the installation is below 2.5.0, they should plan to upgrade to the patched version as soon as possible. Until the update is applied, administrators should monitor access logs for unusual activity in the api/cluster endpoints, particularly unauthorized node modifications or unexpected reload commands.