Nginx UI High-Severity CSRF Flaw Allows Remote Config Changes

Nginx UI, a web-based interface for managing the Nginx web server, contains a high-severity cross-site request forgery (CSRF) vulnerability that allows remote attackers to modify server configurations. The issue, tracked as CVE-2026-107809, affects versions 2.0.0 through 2.4.3 and is rated 8.8 on the CVSS scale.

The vulnerability stems from how the application handles authentication tokens. The front-end stores a JSON Web Token (JWT) in a browser-managed cookie named `token`. The `AuthRequired` middleware accepts this cookie as a valid API credential. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, an attacker can induce a logged-in administrator’s browser to submit authenticated, state-changing requests. While the attacker cannot read the cross-origin response, they can modify Nginx configuration files, trigger service reloads, or invoke other management operations reachable with the victim’s session.

Technical Context

According to the GitHub advisory GHSA-33rr-wq23-g6gg, the root cause is a trust-boundary failure between browser-managed cookies and API bearer-token authentication. The front-end code writes the JWT to the `token` cookie when the token changes. The backend middleware first checks the `Authorization` header and `token` query parameter, but falls back to checking the `token` cookie. This fallback allows browser-initiated cross-site requests to carry a valid API credential automatically.

The route group applies `middleware.AuthRequired()` to many management modules, including configuration, settings, and backup handlers. For accounts without one-time passwords (OTP) or passkeys, the `RequireSecureSession` mechanism does not provide a universal second factor for all state-changing operations. A representative attack path involves an authenticated request writing Nginx configuration via `os.WriteFile` and then calling `nginx.Control(nginx.Reload)`. Cross-Origin Resource Sharing (CORS) policies do not mitigate this issue because preventing cross-origin response reads does not stop cross-site form or no-cors requests from being sent with cookies.

Affected Versions

The vulnerability affects Nginx UI versions 2.0.0 through 2.4.3. In the Go module ecosystem, the vulnerable range is identified as `github.com/0xJacky/Nginx-UI` versions greater than or equal to 1.9.10-0.20250517140552-daee3ac7ade1 and less than 1.9.10-0.20260728074433-a3999bd78a3b. The issue is fixed in version 2.5.0, which corresponds to the patched Go module version 1.9.10-0.20260728074433-a3999bd78a3b.

What should you do?

Administrators should verify their current Nginx UI version and upgrade to 2.5.0 immediately. Until patched, ensure that administrator accounts use strong authentication methods such as passkeys or OTPs, as these may provide additional protection against certain attack vectors. Monitor server logs for unexpected configuration changes or reload events that do not correspond to administrative actions.