CVE-2026-27944 Details
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.
A vulnerability in Nginx UI prior to version 2.3.3 allows unauthenticated access to the /api/backup endpoint, which discloses encryption keys needed to decrypt the backup. The X-Backup-Security response header contains these keys, enabling an attacker to download a full system backup encrypted with AES-256-CBC and immediately decrypt it. The backup includes sensitive data such as user credentials, session tokens, SSL private keys, and Nginx configurations.
Users should update to Nginx UI version 2.3.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-311 | Missing Encryption of Sensitive Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nginxui nginx ui | < 2.3.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 5, 2026 | New CVE Received | [email protected] |