CVE-2026-107813: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-107813 is a Missing Authorization vulnerability in Nginx UI, a web-based management interface for the Nginx web server. It affects versions 2.0.0 through 2.5.0 (exclusive) and represents an incomplete fix for the prior advisory CVE-2026-84315 (GHSA-5v7c-xpfp-p65m). The api/cluster router exposes sensitive node and namespace mutation operations — including cluster-wide Nginx reload/restart — protected only by AuthRequired middleware, without the RequireSecureSession (OTP step-up) enforcement applied to sibling routers. It was published on October 9, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): when the prior fix for GHSA-5v7c-xpfp-p65m wrapped the api/nginx, api/cert, api/dns, api/backup, api/site, and api/stream routers in middleware.RequireSecureSession(), the physically separate api/cluster package was overlooked. Both router groups mount on the same AuthRequired + Proxy group in router/routers.go, but cluster.InitRouter(g) registers all sensitive handlers — AddNode, EditNode, DeleteNode, ReloadNginx, RestartNginx, AddNamespace, ModifyNamespace, DeleteNamespace — directly on the bare authenticated group with no step-up wrapper. An attacker with a stolen or persisted JWT (but no fresh X-Secure-Session-ID) can call these endpoints directly; for example, POST /api/nodes/reload_nginx succeeds while the equivalent POST /api/nginx/reload correctly returns a secure-session challenge. The advisory author source-verified this at HEAD commit 2cb7ee9 (Github Advisory).

A successful exploit allows an authenticated attacker with only a stolen or persisted JWT to perform full cluster node CRUD operations — including reading and rewriting AES-serialized node token secrets used to control remote nodes — effectively compromising cross-node credentials. The attacker can also trigger cluster-wide Nginx reload or restart, disrupting availability across all managed nodes, and add, modify, or delete namespaces. The combined confidentiality, integrity, and availability impact is rated High across all three dimensions, enabling potential lateral movement to every node in the cluster (Github Advisory, Feedly).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability requires low privileges (a valid JWT for any authenticated user) and no user interaction, making it straightforward to exploit if a JWT is obtained. The EPSS score is approximately 0.305% (22nd percentile), indicating a relatively low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys scanner ID 532901 has been assigned for detection (Github Advisory).

1. Obtain a valid JWT: Acquire a JWT for any authenticated Nginx UI user — through session hijacking, token theft from browser storage, log exposure, or a persisted/long-lived token. An OTP-enabled account is the target model, as the step-up bypass is most impactful for such accounts.
2. Identify the target instance: Locate an Nginx UI instance running versions 2.0.0–2.4.x (e.g., via Shodan, Censys, or internal network scanning for the default port).
3. Confirm vulnerability: Send POST /api/nginx/reload with the stolen JWT. If the server returns a secure-session challenge (HTTP 401/403 with OTP prompt), the instance is patched for the nginx router. Then send POST /api/nodes/reload_nginx — if it succeeds (HTTP 200), the cluster router is unprotected and the instance is vulnerable.
4. Enumerate cluster nodes: Call GET /api/nodes to list all registered cluster nodes and their IDs.
5. Extract node credentials: Use POST /api/nodes/:id (EditNode) to read or overwrite the AES-serialized node token secret for a target node, gaining the credential used to control that remote node.
6. Perform cluster-wide disruption or lateral movement: Issue POST /api/nodes/reload_nginx or POST /api/nodes/restart_nginx to restart Nginx across all cluster nodes, or use the extracted node token to authenticate directly to remote nodes and escalate access (Github Advisory).

• Network: Unexpected POST requests to /api/nodes, /api/nodes/:id, /api/nodes/reload_nginx, /api/nodes/restart_nginx, /api/namespaces, or /api/namespaces/:id from unusual source IPs or at unusual times; absence of a corresponding X-Secure-Session-ID header in requests to these endpoints.
• Logs: Nginx UI access logs showing successful (HTTP 200) responses to cluster mutation endpoints (/api/nodes*, /api/namespaces*) without a preceding OTP step-up flow; audit log entries for node CRUD or namespace changes by users who did not recently complete MFA.
• Application State: Unexpected addition, modification, or deletion of cluster nodes or namespaces in the Nginx UI configuration; node token secrets (NGINX_UI_NODE_SECRET) changed without administrator action.
• Process/Service: Unexpected Nginx reload or restart events across multiple cluster nodes occurring simultaneously without a corresponding administrator action in the UI (Github Advisory).

Upgrade Nginx UI to version 2.5.0, which wraps the api/cluster router's mutation handlers in middleware.RequireSecureSession(), mirroring the fix applied to the nginx router (nginx-ui v2.5.0). The v2.5.0 release notes also advise that if any instance ever ran version 2.3.6 or earlier, upgrading alone does not invalidate previously exposed credentials — administrators should rotate NGINX_UI_NODE_SECRET on every node, rotate NGINX_UI_APP_JWT_SECRET to invalidate existing JWTs, and review access logs for unauthorized activity. As interim workarounds for those unable to patch immediately: restrict network-level access to the api/cluster router endpoints, enforce JWT rotation policies to limit token persistence, and monitor for suspicious cluster operations (Github Advisory, Feedly).

The vulnerability was reported by security researcher arpitjain099 and published by the project maintainer 0xJacky as a GitHub Security Advisory on August 12, 2026, with the fix released in v2.5.0 (Github Advisory). The advisory was subsequently indexed by vulnerability aggregators including VulDB, Vulners, CVEFeed, and OSV shortly after NVD publication on October 9, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified.