CVE-2026-107809: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-107809 is a Cross-Site Request Forgery (CSRF) vulnerability in Nginx UI, a web-based management interface for the Nginx web server. The vulnerability affects versions 2.0.0 through 2.4.x (prior to 2.5.0) and stems from the AuthRequired middleware accepting a browser-managed JWT cookie as a valid API credential without enforcing CSRF token validation or Origin/Referer header checks on management endpoints. A remote attacker can induce a logged-in administrator to unknowingly submit authenticated state-changing requests, such as modifying Nginx configuration files. It was published on October 9, 2026, with the advisory originally authored on August 12, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory).

The root cause is a trust-boundary failure (CWE-352) between browser-managed cookies and API bearer-token authentication. The frontend (app/src/pinia/moudule/user.ts) stores the JWT in a non-HttpOnly browser cookie named token. The backend middleware (internal/middleware/middleware.go) in getToken() falls back to reading this cookie after checking the Authorization header and token query parameter, meaning any cross-site browser request automatically carries a valid API credential. The router (router/routers.go) applies middleware.AuthRequired() to a broad set of high-impact management modules — including config.InitRouter, nginx.InitRouter, settings.InitRouter, and backup handlers — without universally enforcing CSRF tokens or Origin/Referer validation. A representative vulnerable sink is api/config/add.go, where an authenticated request calls os.WriteFile to write Nginx configuration and then invokes nginx.Control(nginx.Reload). CORS does not mitigate this because it only prevents reading cross-origin responses, not sending cross-site requests with cookies (Github Advisory, Security Advisory).

Successful exploitation allows an unauthenticated remote attacker to perform administrative operations on behalf of a logged-in administrator, including creating or modifying Nginx configuration files, triggering Nginx reloads or restarts, changing application settings, and invoking backup-related actions. Direct consequences include traffic redirection, reverse proxy tampering, denial of service via malicious configuration, and sensitive configuration changes. In deployments with permissive Nginx modules, configuration tampering may escalate to further server-side compromise or internal network abuse (Github Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.185% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, an administrator must be logged in and visit an attacker-controlled page — and is further constrained to accounts without OTP/Passkey enabled, or to endpoints that do not enforce secure-session proof.

1. Reconnaissance: Identify a publicly accessible or network-reachable Nginx UI instance running versions 2.0.0–2.4.x. Confirm the management URL (e.g., https://nginx-ui.example.com) and that the target administrator account does not have OTP/Passkey enabled.
2. Craft malicious page: Create an attacker-controlled HTML page (e.g., csrf.html) that automatically submits a cross-site POST request to the victim's Nginx UI instance upon page load, targeting a management endpoint such as POST /api/configs.
3. Prepare payload: Construct the POST body with fields such as base_dir, name, content (containing a malicious Nginx configuration), overwrite: true, and optionally sync_node_ids. The attacker does not need to read the response.
4. Deliver the link: Induce the logged-in administrator to visit the attacker-controlled page via phishing, a malicious link, or a compromised third-party site.
5. Exploit cookie fallback: When the administrator's browser loads the page, it automatically submits the cross-site request with the victim's token cookie attached. The Nginx UI backend's getToken() middleware authenticates the request via the cookie fallback.
6. Achieve impact: AuthRequired passes the request as authenticated; AddConfig writes the attacker-supplied Nginx configuration to disk and triggers an Nginx reload, achieving traffic redirection, denial of service, or further server-side impact (Security Advisory, Github Advisory).

• Network: Unexpected cross-origin POST requests to Nginx UI management endpoints (e.g., /api/configs, /api/nginx/reload, /api/nginx/restart, /api/settings) originating from unusual Referer headers or with no Referer header at all.
• Logs: Nginx UI access logs showing authenticated POST requests to management APIs from unexpected IP addresses or with Referer headers pointing to external/unknown domains; audit log entries for configuration writes or Nginx reloads not initiated by a known administrator action.
• File System: Unexpected new or modified Nginx configuration files in the configured base_dir; configuration files with unusual content such as unauthorized proxy_pass directives, allow/deny rules, or embedded scripts.
• Process: Unexpected Nginx reload or restart events (nginx -s reload) not correlated with scheduled maintenance or administrator activity; Nginx serving unexpected traffic patterns following a configuration change.

Upgrade Nginx UI to version 2.5.0 or later, which addresses the CSRF vulnerability (v2.5.0 Release). The fix commit (a3999bd) introduces signed node authentication and related security hardening (Patch Commit). For administrators unable to upgrade immediately, enforce OTP/Passkey authentication on all administrator accounts to reduce the attack surface, as endpoints requiring secure-session proof are not exploitable via this CSRF vector. Additionally, restrict network access to the Nginx UI management interface to trusted IP ranges only. After upgrading, rotate the JwtSecret (NGINX_UI_APP_JWT_SECRET) to invalidate previously issued JWTs, and review administrator accounts and access logs for unauthorized activity (Github Advisory).

The vulnerability was noted on Mastodon by TheHackerWire shortly after disclosure. Tenable added detection coverage via a cloud security plugin (plugin ID 474039). The advisory was indexed by multiple vulnerability tracking platforms including VulDB, Vulners, OSV, and CIRCL shortly after publication, indicating standard community awareness. No significant researcher commentary or media coverage beyond routine aggregation has been observed.