CVE-2026-42220: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in 0xJacky nginx-ui
A vulnerability in 0xJacky's nginx-ui prior to version 2. 3. 8 allows an authenticated user to retrieve sensitive configuration values via the GET /api/settings endpoint. This includes the node. secret value, which can be used to bypass normal authentication by presenting it in a header or query parameter, granting access as a trusted node with elevated privileges. The issue has been addressed in version 2. 3. 8.
AI Analysis
Technical Summary
The nginx-ui web interface for the Nginx web server contains an information exposure vulnerability (CWE-200) combined with improper authorization (CWE-863) in versions before 2.3.8. Authenticated users can access the GET /api/settings endpoint to obtain sensitive configuration data, notably the node.secret. This secret is accepted by the AuthRequired() function via the X-Node-Secret header or node_secret query parameter, allowing the request to be treated as authenticated through a trusted-node mechanism and associated with the init user, effectively elevating privileges. This vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) and was fixed in version 2.3.8.
Potential Impact
An authenticated user can expose sensitive configuration information, including node.secret, which can be leveraged to bypass normal authentication controls and gain elevated access as a trusted node with init user privileges. This could lead to unauthorized access to administrative functions without further authentication. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade nginx-ui to version 2.3.8 or later, where this vulnerability has been patched. Since this is a product vulnerability and not a cloud service, applying the official fix is necessary to remediate the issue. No alternative mitigations are indicated in the advisory.
CVE-2026-42220: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in 0xJacky nginx-ui
Description
A vulnerability in 0xJacky's nginx-ui prior to version 2. 3. 8 allows an authenticated user to retrieve sensitive configuration values via the GET /api/settings endpoint. This includes the node. secret value, which can be used to bypass normal authentication by presenting it in a header or query parameter, granting access as a trusted node with elevated privileges. The issue has been addressed in version 2. 3. 8.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The nginx-ui web interface for the Nginx web server contains an information exposure vulnerability (CWE-200) combined with improper authorization (CWE-863) in versions before 2.3.8. Authenticated users can access the GET /api/settings endpoint to obtain sensitive configuration data, notably the node.secret. This secret is accepted by the AuthRequired() function via the X-Node-Secret header or node_secret query parameter, allowing the request to be treated as authenticated through a trusted-node mechanism and associated with the init user, effectively elevating privileges. This vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) and was fixed in version 2.3.8.
Potential Impact
An authenticated user can expose sensitive configuration information, including node.secret, which can be leveraged to bypass normal authentication controls and gain elevated access as a trusted node with init user privileges. This could lead to unauthorized access to administrative functions without further authentication. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade nginx-ui to version 2.3.8 or later, where this vulnerability has been patched. Since this is a product vulnerability and not a cloud service, applying the official fix is necessary to remediate the issue. No alternative mitigations are indicated in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-25T05:04:37.029Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f90348cbff5d8610482e36
Added to database: 5/4/2026, 8:36:24 PM
Last enriched: 5/4/2026, 8:51:40 PM
Last updated: 5/4/2026, 9:38:07 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.