## Summary
In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in forwarding headers.
## Impact
This has two distinct effects in bundled-proxy deployments:
* **IP allowlist enforcement:** management API requests forwarded by the bundled proxy were identified as loopback and could pass the loopback exception even when the external source was not in the configured allowlist. Protected management operations still required valid credentials; this did not grant unauthenticated administrator access.
* **Login availability:** failed login attempts from different external sources were attributed to one loopback address. An unauthenticated attacker could therefore trigger the shared temporary login-ban threshold and deny password or OTP login to other users behind the proxy until the ban expired. Existing authenticated sessions were not invalidated.
## Remediation
Upgrade to Nginx UI 2.6.0 or later. The fix explicitly trusts only the intended bundled proxy, validates configured trusted proxies, uses the resolved client address consistently, and fails closed when an IP allowlist is enabled but the client address is invalid.
Fix commit: https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
CVE-2026-42238 is a critical code injection vulnerability in 0xJacky's nginx-ui prior to version 2.3.8. The vulnerability arises because the backup restore endpoint is unauthenticated for the first 10 minutes after startup on fresh installations. An attacker can exploit this by uploading a crafted backup archive that overwrites configuration files, allowing arbitrary OS command injection via the TestConfigCmd setting. This command executes with the privileges of the nginx-ui process user, often root in Docker deployments. The issue is patched in version 2.3.8.
CVE-2026-42223 is a vulnerability in 0xJacky's nginx-ui prior to version 2.3.8 where the GetSettings API handler exposes over 40 sensitive configuration fields to authenticated users. These fields include JwtSecret, NodeSecret, OIDC ClientSecret, and IP whitelist configurations. The issue arises because the protection tag on sensitive fields is enforced only during writes but ignored during reads, leading to unintended disclosure of sensitive information. This vulnerability has been patched in version 2.3.8. The CVSS score is 6.5, indicating a medium severity level.
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
CVE-2026-42221 is a high-severity vulnerability in 0xJacky's nginx-ui versions 2.0.0 up to but not including 2.3.8. It allows an unauthenticated remote attacker to claim the initial administrator account during the first-run setup by accessing the public /api/install endpoint without authentication. This leads to permanent takeover of the initial instance by setting the admin email, username, and password. The vulnerability arises because the installation endpoint lacks authentication, and encryption only protects data in transit, not the authorization of the installer. This issue has been fixed in version 2.3.
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.
CVE-2026-34403 is a medium severity vulnerability in 0xJacky's nginx-ui prior to version 2.3.5. The issue arises because all WebSocket endpoints use a gorilla/websocket Upgrader with CheckOrigin always returning true, which allows Cross-Site WebSocket Hijacking (CSWSH). Since authentication tokens are stored in browser cookies without HttpOnly or SameSite attributes, a malicious webpage can establish authenticated WebSocket connections if an administrator visits it. Version 2.3.5 addresses this vulnerability.
CVE-2026-33031 is an improper access control vulnerability in 0xJacky's nginx-ui versions prior to 2.3.4. The issue allows users who have been disabled by an administrator to continue using previously issued API tokens until those tokens expire. This means that disabling a compromised account does not immediately revoke access, enabling an attacker with a stolen JWT to keep reading and modifying protected resources. Additionally, since tokens can be used to create new accounts, the disabled user may maintain privileges indefinitely. Version 2.3.4 addresses this vulnerability.
CVE-2026-33026 is a critical vulnerability in the 0xJacky nginx-ui web user interface for the Nginx web server. Versions prior to 2.3.4 have a flaw in the backup restore mechanism that allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue involves cleartext storage of sensitive information and improper validation of backup archives. The vulnerability has been patched in version 2.3.4. The CVSS 4.0 score is 9.4, indicating a critical severity level.
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination. This issue has been patched in version 2.3.4.
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.
CVE-2026-33030 affects nginx-ui versions 2.3.3 and earlier, where an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to access, modify, or delete resources belonging to other users. This occurs because the application's base Model struct lacks a user_id field, and resource endpoints do not verify user ownership, resulting in complete authorization bypass in multi-user environments. No patches are publicly available at this time. The vulnerability has a high severity with a CVSS score of 8.8.
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.