Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/0xJacky/Nginx-UI

41 known vulnerabilities (6 critical, 27 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release
v1.1.0 (Jan 27, 2022): affected by 31 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
41 · 6 critical, 27 high, 8 medium
Releases
1 since v1.1.0 (Jan 27, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 41 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 41

  • Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

    Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0; all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

    Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0.

    No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

    Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0.

    No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

    Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0.

    No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

    Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0.

    No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

    Affected: all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-84321Medium 5.4

    Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

    Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0.

    No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

    Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0.

    No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • CVE-2026-84320Medium 6.3

    Nginx UI: Auto backup name allows path traversal outside validated storage path

    Affected: fixed in 1.9.10-0.20260715121709-f92218e01054.

    No fix released. The advisory names 1.9.10-0.20260715121709-f92218e01054 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

    Affected: from 1.9.10-0.20250506154222-1330888280a2, fixed in 1.9.10-0.20260703131214-23d1934099b0.

    No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet.

  • Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

    Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0.

    No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

    Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074433-a3999bd78a3b.

    No fix released. The advisory names 1.9.10-0.20260728074433-a3999bd78a3b as the fix, which the registry doesn't have yet.

  • Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

    Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728114330-580585516dd8.

    No fix released. The advisory names 1.9.10-0.20260728114330-580585516dd8 as the fix, which the registry doesn't have yet.

  • 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

    Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728091109-0ecbd106c37b.

    No fix released. The advisory names 1.9.10-0.20260728091109-0ecbd106c37b as the fix, which the registry doesn't have yet.

  • Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

    Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074146-a467ed652591.

    No fix released. The advisory names 1.9.10-0.20260728074146-a467ed652591 as the fix, which the registry doesn't have yet.

Show all 41 advisoriesShow fewer advisories

  • Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

    Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074433-a3999bd78a3b.

    No fix released. The advisory names 1.9.10-0.20260728074433-a3999bd78a3b as the fix, which the registry doesn't have yet.

  • Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

    Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074558-95cd21b70814.

    No fix released. The advisory names 1.9.10-0.20260728074558-95cd21b70814 as the fix, which the registry doesn't have yet.

  • Nginx UI: Node Secret Credential Exposure via URL Query Parameter

    Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074433-a3999bd78a3b.

    No fix released. The advisory names 1.9.10-0.20260728074433-a3999bd78a3b as the fix, which the registry doesn't have yet.

  • CVE-2026-107806Critical 9.4

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

    Affected: from 1.9.10-0.20260421071512-7864e378f5cf, fixed in 1.9.10-0.20260728074146-a467ed652591.

    No fix released. The advisory names 1.9.10-0.20260728074146-a467ed652591 as the fix, which the registry doesn't have yet.

  • Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

    Affected: from 1.9.10-0.20260729084040-acb59fdd81db, fixed in 1.9.10-0.20260901043436-8c9b9a1aff21.

    No fix released. The advisory names 1.9.10-0.20260901043436-8c9b9a1aff21 as the fix, which the registry doesn't have yet.

  • CVE-2026-107804Medium 5.3

    Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

    Affected: from 1.9.10-0.20251005005631-6de168c9454, fixed in 1.9.10-0.20260904075558-e30e331303fc; fixed in 1.9.10-0.20260904075558-e30e331303fc.

    No fix released. The advisory names 1.9.10-0.20260904075558-e30e331303fc as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

    Affected: all versions; through 2.3.4.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-42238Critical 9.0

    Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

    Affected: all versions; fixed in 2.3.8.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-42223Medium 6.5

    nginx-ui: Settings API Exposes Protected Secrets

    Affected: all versions; fixed in 2.3.8.

    No fix released. The latest release, v1.1.0, is still affected.

  • nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

    Affected: versions 2.3.5; all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

    Affected: from 2.0.0, fixed in 2.3.8; all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-42220Medium 6.5

    nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and…

    Affected: all versions; through 1.9.9.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-34403Medium 5.5

    Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

    Affected: fixed in 1.9.10-0.20260316053337-1a9cd29a3082.

    No fix released. The advisory names 1.9.10-0.20260316053337-1a9cd29a3082 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Nginx-UI: Disabled users retain full API access through previously issued bearer tokens

    Affected: fixed in 1.9.10-0.20260314152518-7b66578adb47.

    No fix released. The advisory names 1.9.10-0.20260314152518-7b66578adb47 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • CVE-2026-33026Critical 9.4

    nginx-ui Backup Restore Allows Tampering with Encrypted Backups

    Affected: all versions; fixed in 1.9.10-0.20260315015203-f61bcec547c0.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-33027Medium 6.9

    Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory

    Affected: through 1.99; all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse

    Affected: through 1.99; all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-33029Medium 6.9

    Nginx UI: DoS via Negative Integer Input in Logrotate Interval

    Affected: all versions; through 1.99.

    No fix released. The latest release, v1.1.0, is still affected.

  • Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys

    Affected: through 1.99; all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-33032Critical 9.8

    Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

    Affected: through 1.99; all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2026-27944Critical 9.8

    Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

    Affected: all versions; fixed in 2.3.3.

    No fix released. The latest release, v1.1.0, is still affected.

  • Nginx-UI authenticated RCE through injecting into the application config via CRLF

    Affected: all versions; fixed in 1.9.10-0.20240126104956-d70e37c8575e.

    No fix released. The latest release, v1.1.0, is still affected.

  • CVE-2024-23827Critical 9.8

    Nginx-UI arbitrary file write through the Import Certificate feature

    Affected: fixed in 1.9.10-0.20240128060047-8581bdd3c6f4; all versions.

    No fix released. The latest release, v1.1.0, is still affected.

  • Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

    Affected: fixed in 1.9.10-0.20231219184941-827e76c46e63.

    No fix released. The advisory names 1.9.10-0.20231219184941-827e76c46e63 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

    Affected: fixed in 1.9.10-0.20231219195202-ec93ab05a3ec.

    No fix released. The advisory names 1.9.10-0.20231219195202-ec93ab05a3ec as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.

  • Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

    Affected: fixed in 1.9.10-0.20231219184941-827e76c46e63.

    No fix released. The advisory names 1.9.10-0.20231219184941-827e76c46e63 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected.