CVE-2026-42220 Details
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.
A vulnerability in Nginx UI prior to version 2.3.8 allows authenticated users to access sensitive configuration data, including the node.secret, through the GET /api/settings endpoint. This node.secret can be used to bypass standard authentication and access privileged actions via the trusted-node path, such as downloading backup archives and restoring Nginx UI state, which can disrupt normal operations. The issue arises because the settings endpoint lacks proper authorization controls and exposes sensitive data that can be reused to gain unauthorized access to critical functionalities.
Users are advised to update Nginx UI to version 2.3.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-7jrr-xw9c-mj39 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8 | [email protected] | Release Notes |
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-7jrr-xw9c-mj39 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nginxui nginx ui | < 2.3.8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |