CVE-2026-107811: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-107811 is a cross-node authentication bypass vulnerability in Nginx UI, a web-based management interface for the Nginx web server. Affecting versions 2.0.0 through 2.5.0 (exclusive), it allows any ordinary authenticated user to extract cluster node shared secrets via the /api/nodes and /api/nodes/:id endpoints and use them to impersonate a trusted node against remote cluster members. The vulnerability was published on October 9, 2026, with the fix available in version 2.5.0. It carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory, Security Advisory).

The vulnerability stems from two compounding weaknesses classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-862 (Missing Authorization). First, router/routers.go mounts cluster.InitRouter(g) inside the shared /api authenticated route group without any administrator-level authorization gate, meaning any valid JWT holder can reach node management endpoints. Second, model/node.go defines the Token field with the JSON tag json:"token", causing the node shared secret to be serialized and returned in API responses from GetNode and GetNodeList handlers. The second half of the exploit chain lies in internal/middleware/middleware.go: if the X-Node-Secret header (or node_secret query parameter) matches settings.NodeSettings.Secret, the middleware immediately elevates the request to initUser — bypassing normal JWT-based authentication entirely — making the leaked token directly reusable for privilege escalation across cluster nodes (Github Advisory, Security Advisory).

Successful exploitation allows any low-privileged authenticated user to achieve initUser-level access on remote cluster nodes without possessing a legitimate high-privileged session on those nodes. Attackers can invoke sensitive management operations including system restarts (POST /api/system/restart), Nginx reload/restart, and configuration synchronization across all managed nodes. This enables lateral movement across the entire cluster management plane, potentially resulting in full compromise of all nodes managed by the Nginx UI instance, with high confidentiality, integrity, and availability impact (Github Advisory).

A proof-of-concept exploit chain is publicly documented in the GitHub Security Advisory, providing concrete step-by-step reproduction instructions requiring only a valid low-privileged account and network reachability to the target cluster node's management interface. The NVD SSVC assessment classifies exploitation status as "poc" with "total" technical impact. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.356% (28th percentile), and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Qualys has added detection support (detection ID 532899) (Github Advisory, Security Advisory).

1. Authenticate as a low-privileged user: Send POST /api/login with a JSON body containing name and password credentials. Capture the returned JWT token from the response.
2. Enumerate cluster nodes: Send GET /api/nodes or GET /api/nodes/:id with the JWT in the Authorization header. The API response will include each node's url and token fields in plaintext JSON.
3. Extract the node secret: Parse the JSON response and record the target node's url (management address) and token (the shared X-Node-Secret value).
4. Impersonate the trusted node: Send a request directly to the target node's management API with the X-Node-Secret header set to the extracted token value. The middleware will match the secret against settings.NodeSettings.Secret and elevate the request to initUser.
5. Execute sensitive management operations: Invoke high-risk endpoints on the remote node, such as POST /api/system/restart, to trigger service restarts, Nginx reloads, or configuration synchronization. A 200 response confirms successful cross-node authentication bypass and initUser-level access (Security Advisory).

• Network: Unexpected GET requests to /api/nodes or /api/nodes/:id from low-privileged user accounts; POST requests to sensitive management endpoints (e.g., /api/system/restart) on cluster nodes originating from unusual source IPs or user sessions; presence of X-Node-Secret header in HTTP requests from non-node sources.
• Logs: Nginx UI access logs showing low-privileged user accounts querying /api/nodes endpoints followed shortly by management API calls with X-Node-Secret headers; authentication log entries showing initUser sessions not associated with legitimate node-to-node communication.
• Behavioral: Unexpected Nginx service restarts or configuration changes across cluster nodes; configuration synchronization events not initiated by administrators; cluster node management operations occurring outside normal maintenance windows (Security Advisory).

Upgrade Nginx UI to version 2.5.0 or later, which replaces the shared node secret mechanism with per-controller Ed25519 cryptographic credentials and automated credential lifecycle management (v2.5.0 Release). Important: If any instance ever ran version 2.3.6 or earlier, upgrading alone does not invalidate previously exposed credentials. After upgrading all cluster nodes to v2.5.0, confirm each node relationship shows "Paired signature," then rotate [node] Secret (NGINX_UI_NODE_SECRET) on every instance with a new unique random value and restart. Additionally, rotate [app] JwtSecret (NGINX_UI_APP_JWT_SECRET) to invalidate previously issued JWTs, and review administrator accounts and access logs for unauthorized activity. As a network-level workaround, implement network segmentation to restrict access to cluster management APIs to trusted hosts only (v2.5.0 Release, Github Advisory).

The vulnerability was reported by researcher PLpaPLpa and published by the project maintainer 0xJacky. The v2.5.0 release notes include an explicit warning that installations running version 2.3.6 or earlier require additional remediation steps beyond upgrading, indicating the maintainer took the disclosure seriously and provided detailed post-upgrade guidance. The advisory has been indexed by multiple vulnerability tracking platforms including Qualys, Tenable, INCIBE, and GitLab Advisories, reflecting broad industry awareness (v2.5.0 Release, Github Advisory).