The Nginx-UI Settings API (CVE-2026-42223) improperly exposes protected secret fields in its GetSettings API endpoint. Although many sensitive fields are tagged as protected, this protection is only enforced during settings writes, not reads. As a result, authenticated users can retrieve over 40 protected fields including JwtSecret, NodeSecret, OIDC ClientSecret, and IP whitelist configurations. This exposure allows attackers to forge authentication tokens, impersonate cluster nodes, and potentially take over OAuth accounts.