Organisations at Risk: Nginx UI Flaw Lets Hackers Steal Secrets from Logs to Bypass All Admin Security

Nginx UI, a web interface for the Nginx web server, contains a high-severity vulnerability that exposes its master credential in plaintext across multiple data stores. The flaw, tracked as CVE-2026-107807 with a CVSS score of 8.8, allows any party with read access to HTTP logs, proxy logs, or browser history to obtain the `Node.Secret`. This credential provides persistent administrative API access, effectively bypassing all standard authentication mechanisms including passwords, JWT tokens, sessions, and second-factor checks.

How does the credential exposure occur?

The issue stems from how Nginx UI handles the `Node.Secret` master credential. According to the National Vulnerability Database and GitHub advisory GHSA-pvgv-gcp7-v38g, the application accepts this secret via the `node_secret` query parameter in HTTP and WebSocket authentication paths. This design choice allows the secret to appear in URL query strings instead of requiring the more secure `X-Node-Secret` header.

Consequently, the credential is recorded in plaintext in access logs, reverse proxy logs, browser history, HTTP `Referer` headers, and configuration URLs. The official cluster configuration format further exacerbates this by embedding node secrets directly into URL query strings stored in `app.ini` and environment variables.

What can an attacker do with the exposed secret?

An attacker who obtains the `Node.Secret` can gain full, unauthenticated administrative access to the Nginx UI API. The vulnerability allows them to read sensitive materials such as TLS private keys and modify Nginx configurations. The GitHub advisory notes that when chained with another bug, this access can lead to OS-level code execution. The middleware sets the request context to an admin-level user when the secret matches, bypassing all validation checks. This means the attacker does not need to guess passwords or steal session cookies; the secret alone is sufficient for complete control.

Which versions are affected?

The vulnerability affects Nginx UI versions starting from 2.0.0 up to, but not including, 2.5.0. The vendor has released a fix in version 2.5.0. The GitHub advisory specifies that the Go package `github.com/0xJacky/Nginx-UI` is vulnerable in versions >= 1.9.10-0.20250517140552-daee3ac7ade1 and < 1.9.10-0.20260728074433-a3999bd78a3b. The patched version is 1.9.10-0.20260728074433-a3999bd78a3b. Organizations using any version in this range should consider themselves at risk if their logs or configuration files are accessible to unauthorized parties.

What steps should organizations take now?

Administrators should immediately audit their Nginx UI deployments to determine if they are running a vulnerable version. If an update to version 2.5.0 is available, it should be applied as soon as possible. Until a patch is applied, organizations should review their access logs, proxy logs, and configuration files for any instances of the `node_secret` query parameter. If the secret has been exposed, it must be rotated immediately, as any previous instance of the secret remains valid for authentication bypass.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Nginx UI

• Check your Nginx UI version and upgrade to 2.5.0 or later if you are currently running a version between 2.0.0 and 2.5.0.
• Review HTTP access logs, proxy logs, and browser history for any URLs containing the `node_secret` query parameter.
• Rotate the `Node.Secret` if you suspect it has been logged or exposed in configuration files or environment variables.
• Restrict access to log aggregation systems and configuration files to prevent unauthorized reading of sensitive data.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107807?

CVE-2026-107807 is a high-severity vulnerability in Nginx UI that allows the master credential to be exposed in URL query parameters, leading to authentication bypass.

Which versions of Nginx UI are vulnerable?

Versions 2.0.0 through 2.5.0 (exclusive) are affected by this vulnerability.

Is there a fix available?

Yes, the issue is fixed in version 2.5.0 of Nginx UI.