NG
Product
nginx-ui
36
CVEs
0
On KEV
9.9
Max CVSS
21
New 30D
Severity mix
Critical 8High 21Medium 7Low 0
Watch
Add nginx-ui to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-84316 | 8.8 | Oct 12 | Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) Affected: < 2.4.1 |
| CVE-2026-84317 | 8.8 | Oct 12 | Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) Affected: < 2.4.1 |
| CVE-2026-84313 | 8.8 | Oct 12 | Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover Affected: < 2.4.1 |
| CVE-2026-84318 | 8.8 | Oct 12 | Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE Affected: >= 2.0.0-rc.6, < 2.4.1 |
| CVE-2026-107813 | 8.8 | Oct 9 | Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up Affected: >= 2.0.0, < 2.5.0 |
| CVE-2026-107811 | 8.8 | Oct 9 | 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser Affected: >= 2.0.0, < 2.5.0 |
| CVE-2026-107809 | 8.8 | Oct 9 | Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs Affected: >= 2.0.0, < 2.5.0 |
| CVE-2026-107807 | 8.8 | Oct 9 | Nginx UI: Node Secret Credential Exposure via URL Query Parameter Affected: >= 2.0.0, < 2.5.0 |
| CVE-2026-84314 | 8.7 | Oct 12 | Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint Affected: < 2.4.1 |
| CVE-2026-84319 | 8.3 | Oct 12 | Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context Affected: < 2.4.1 |
| CVE-2026-84315 | 8.3 | Oct 12 | Nginx UI OTP secure-session step-up is missing on sensitive mutation routes Affected: < 2.4.1 |
| CVE-2026-84360 | 8.1 | Oct 12 | Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools Affected: < 2.4.1 |
| CVE-2026-107810 | 8.1 | Oct 9 | Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied Affected: >= 2.0.0, < 2.5.0 |
| CVE-2026-107808 | 8.1 | Oct 9 | Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) Affected: >= 2.0.0, < 2.5.0 |
| CVE-2026-34403 | 8.1 | Apr 20 | Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints Affected: < 2.3.5 |
| CVE-2026-33031 | 8.1 | Apr 20 | Nginx-UI: Disabled users retain full API access through previously issued bearer tokens Affected: < 2.3.4 |
| CVE-2026-107812 | 7.5 | Oct 9 | Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM Affected: >= 2.0.0, < 2.5.0 |
| CVE-2026-107805 | 7.5 | Oct 9 | Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage Affected: >= 2.5.0, < 2.6.0 |
| CVE-2026-33028 | 7.5 | Mar 30 | Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse Affected: < 2.3.4 |
| CVE-2026-107806 | 7.2 | Oct 9 | Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite Affected: >= 2.3.8, < 2.5.0 |
| CVE-2026-84312 | 7.1 | Oct 12 | Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) Affected: < 2.4.1 |
Showing 21