Patch Forecast
Amber warning
Patch this week.

CVE-2026-107807 · GHSA-pvgv-gcp7-v38g

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Risk score
72/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.3%
Published
9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, …
Affected
github.com/0xJacky/Nginx-UI (go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b
Fix
Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074433-a3999bd78a3b or later.
Exploitation
Public proof of concept

Story map

Story map: github.com/0xJacky/Nginx-UITHE FLAWSTHE FIXCVE-2026-107807Nginx UI: Node SecretCredential Exposure via URLQuery ParameterCVSS 8.8 · EPSS 0%CVE-2026-107808Nginx UI: Authenticationbypass: password login does notenforce a passkey-only second…CVSS 8.1 · EPSS 0%CVE-2026-107809Nginx-UI AuthRequired tokencookie fallback enables CSRFagainst management APIsCVSS 8.8 · EPSS 0%CVE-2026-1078110xJacky/nginx-ui /api/nodesLeaks Cluster Node Tokens andAllows Cross-Node…CVSS 8.8 · EPSS 0%Upgrade…2.5.0or later on your release lineWho is exposedgithub.com/0xJacky/Nginx-UI(go) >=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95…AMBER · PATCH THIS WEEKgithub.com/0xJacky/Nginx-UINginx UI is a web user interfacefor the Nginx web server. From2.0.0 until 2.5.0, POST /api/loginchecks EnabledOTP but does notrequire a WebAuthn assertionwhen EnabledPasskey is true andno TOTP secret is configured. A…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-312 (CWE-312)13 other warnings in 30 days →Same productEarlier github.com/0xJacky/Nginx-UI warnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/0xJacky/Nginx-UI: Amber, patch this week. Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2…

The flaws

  • CVE-2026-107807: Nginx UI: Node Secret Credential Exposure via URL Query Parameter (CVSS 8.8 · EPSS 0%)
  • CVE-2026-107808: Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) (CVSS 8.1 · EPSS 0%)
  • CVE-2026-107809: Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs (CVSS 8.8 · EPSS 0%)
  • CVE-2026-107811: 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser (CVSS 8.8 · EPSS 0%)

The fix

Upgrade github.com/0xJacky/Nginx-UI: 2.5.0 or later on your release line

Who is exposed: github.com/0xJacky/Nginx-UI (go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 8.8 high
  • Public exploit or proof of concept referenced
  • On your watchlist: nginx, Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/0xJacky/Nginx-UIgo>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b1.9.10-0.20260728074433-a3999bd78a3b

References

Original description

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.

Last activity 9 Oct 2026. Patch Forecast updates every hour.