CVE-2026-33030: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-33030 is an Insecure Direct Object Reference (IDOR) vulnerability combined with unencrypted storage of sensitive credentials in nginx-UI, a web-based management interface for Nginx. The vulnerability allows any authenticated user to access, modify, and delete resources belonging to other users, and to extract DNS API tokens and ACME private keys stored in plaintext. It affects all versions of nginx-UI up to and including v2.3.3. The vulnerability was discovered on 2026-03-13 via source code audit, published to the GitHub Advisory Database on 2026-03-28, and assigned CVE-2026-33030 on 2026-03-30. It carries a CVSS v3.1 score of 8.8 (High) (Github Advisory, Security Advisory).

The root cause is twofold: the application's base Model struct in model/model.go lacks a user_id field (CWE-639: Authorization Bypass Through User-Controlled Key), and all resource API endpoints (e.g., /api/dns_credentials/{id}) perform database queries by resource ID alone without verifying that the requesting user owns the resource. Additionally, the dns.Config structure in internal/cert/dns/config_env.go stores DNS provider API credentials (e.g., Cloudflare CF_API_TOKEN, AWS AWS_ACCESS_KEY_ID, GoDaddy GODADDY_API_KEY) and ACME private keys in plaintext rather than using the AES encryption serializer already available in the codebase. An attacker with any valid authentication token can enumerate resource IDs sequentially and retrieve other users' credentials directly from HTTP responses without any decryption step. The advisory also lists CWE-78 (OS Command Injection) as a weakness, though the primary attack vector described is the IDOR/plaintext storage chain (Github Advisory, Security Advisory).

Successful exploitation allows any authenticated low-privilege user to read, modify, or delete all resources owned by other users — including administrators — in multi-user nginx-UI deployments. The most severe consequence is the direct theft of plaintext DNS provider API tokens (Cloudflare, AWS Route53, Alibaba Cloud, Tencent Cloud, GoDaddy) and ACME private keys, enabling full DNS zone control, fraudulent SSL/TLS certificate issuance, domain hijacking, traffic interception, and potential lateral movement into cloud infrastructure (e.g., AWS IAM escalation via stolen access keys). Availability is also impacted, as attackers can delete or corrupt certificates and DNS configurations, disrupting services (Github Advisory, Security Advisory).

No confirmed in-the-wild exploitation has been reported, and no weaponized exploit kit is known to exist. The GitHub Advisory includes an illustrative proof-of-concept curl command demonstrating credential extraction via IDOR, but it is not a step-by-step attack guide against a live system. The EPSS score is approximately 0.019% (Feedly data) to 0.047% (GitHub Advisory Database), indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid (low-privilege) authenticated session, making it accessible to any registered user in a multi-tenant deployment (Github Advisory, Security Advisory).

1. Obtain authentication credentials: Register or obtain a low-privilege account on the target nginx-UI instance (v2.3.3 or earlier).
2. Authenticate and retrieve a session token: Log in to the nginx-UI web interface or API to obtain a valid Authorization bearer token.
3. Enumerate resource IDs via IDOR: Send sequential GET requests to resource endpoints, incrementing the numeric ID parameter to discover resources owned by other users:

   curl -H "Authorization: $ATTACKER_TOKEN" https://nginx-ui.example.com/api/dns_credentials/1
   curl -H "Authorization: $ATTACKER_TOKEN" https://nginx-ui.example.com/api/dns_credentials/2

4. Extract plaintext credentials: Parse the JSON response, which returns DNS API tokens (e.g., CF_API_TOKEN, AWS_ACCESS_KEY_ID) and ACME private keys in cleartext — no decryption required.
5. Abuse stolen credentials: Use the extracted tokens to take over DNS zones (e.g., modify Cloudflare DNS records), issue fraudulent Let's Encrypt certificates via ACME, intercept traffic, or pivot into cloud infrastructure using AWS/Alibaba/Tencent credentials.
6. Modify or delete victim resources: Optionally, use IDOR to modify or delete other users' certificates, site configurations, or streams via PUT/DELETE requests to the same endpoints (Github Advisory, Security Advisory).

• Network: Repeated GET requests to /api/dns_credentials/{id}, /api/certs/{id}, /api/acme_users/{id}, or similar resource endpoints with sequentially incrementing IDs from a single authenticated session; requests to these endpoints from users who do not own the corresponding resources.
• Logs: nginx-UI access logs showing a single user account accessing resource IDs belonging to multiple different users in rapid succession; HTTP 200 responses to cross-user resource requests that should return 403.
• File System: Unexpected new DNS records or SSL certificates issued for domains managed by the nginx-UI instance; evidence of ACME certificate requests from unfamiliar IP addresses.
• Cloud/External: Unauthorized DNS record changes in Cloudflare, AWS Route53, GoDaddy, Alibaba Cloud, or Tencent Cloud DNS consoles; new SSL certificates issued via Let's Encrypt for managed domains from unexpected ACME accounts (Github Advisory).

The primary remediation is to upgrade nginx-UI to v2.3.4 or later, which was released on 2026-03-15 and includes security patches addressing these issues (v2.3.4 Release). If immediate upgrade is not possible, restrict nginx-UI access to trusted users only and avoid multi-user deployments on affected versions. The advisory recommends adding a user_id field to the base Model struct and filtering all resource queries by the authenticated user's ID, as well as applying AES encryption (serializer:json[aes]) to the Config field in model/dns_credential.go and the Key field in model/acme_user.go. Existing plaintext data must be re-saved after the fix to trigger encryption migration. Long-term improvements include implementing RBAC, audit logging, and authorization integration tests (Github Advisory, Security Advisory).

The vulnerability received coverage from several security news outlets and aggregators shortly after disclosure, including The Hacker Wire and press release aggregators noting the risk of DNS zone takeover and certificate hijacking. A Reddit post in r/pwnhub titled "Critical nginx UI vulnerability exposed attackers" generated community discussion. F5 Labs included the vulnerability in their weekly threat bulletin for April 22, 2026. The OpenSUSE security announce mailing list also referenced the issue in the context of govulncheck/vulndb updates. Overall community sentiment reflects concern about the plaintext credential storage compounding the IDOR risk, particularly for deployments managing production DNS and TLS infrastructure (The Hacker Wire, F5 Labs).