Nginx UI Exposes Master Credentials in URL Logs, Allowing Full Admin Bypass

A high-severity vulnerability in Nginx UI, a web interface for the Nginx web server, has been disclosed that exposes the application’s master credential in plaintext within URL query parameters. The flaw, tracked as CVE-2026-107807 with a CVSS score of 8.8, allows attackers to bypass all authentication mechanisms, including passwords, JWT tokens, and two-factor authentication, by extracting the secret from logs or browser history.

The vulnerability stems from how Nginx UI handles the `Node.Secret` credential. According to the GitHub advisory GHSA-pvgv-gcp7-v38g, the application accepts this master credential through the `node_secret` query parameter in HTTP and WebSocket authentication paths when the `X-Node-Secret` header is absent. This design choice causes the sensitive credential to be recorded in plaintext in HTTP access logs, reverse proxy logs, browser history, and HTTP `Referer` headers. Additionally, the official cluster configuration format embeds node secrets directly into URL query strings stored in `app.ini` and environment variables, creating a systemic exposure pattern across cluster deployments.

Context and Background

The `Node.Secret` serves as a master credential that bypasses standard authentication checks for the entire API. When a request contains a matching secret via the query parameter, the middleware sets the request context to an admin-level user and proceeds without validating JWT sessions or second-factor checks. This behavior applies to all authenticated HTTP and WebSocket endpoints, including the WebSocket origin checker.

An attacker who gains read access to any log aggregation system, proxy log, or configuration file can extract the node secret. Possession of this secret grants full, persistent, unauthenticated administrative access to the Nginx UI API. This includes the ability to read TLS private keys, modify Nginx configurations, and potentially achieve OS-level code execution when chained with other vulnerabilities, such as Bug #1 mentioned in the advisory.

Who Is Affected

The vulnerability affects Nginx UI versions from 2.0.0 up to, but not including, 2.5.0. The National Vulnerability Database lists the affected range as >= 2.0.0, < 2.5.0. The GitHub advisory identifies the vulnerable Go package as `github.com/0xJacky/Nginx-UI` with versions >= 1.9.10-0.20250517140552-daee3ac7ade1 and < 1.9.10-0.20260728074433-a3999bd78a3b. The issue is resolved in version 2.5.0, which corresponds to the patched package version 1.9.10-0.20260728074433-a3999bd78a3b.

What should you do?

Administrators using Nginx UI should immediately verify their version and upgrade to 2.5.0 or later to mitigate this exposure. Until an update is applied, organizations should review access logs, proxy logs, and configuration files for any instances where the `node_secret` query parameter may have been recorded. If exposure is suspected, rotate all master credentials and revoke any active sessions or tokens. Monitor for unauthorized administrative activity, such as unexpected configuration changes or access to TLS keys.