Critical Nginx UI Backup Exposure (CVE‑2026‑27944) Allows Unauthenticated Decryption of Server Backups
What It Is – A newly disclosed vulnerability in the Nginx UI management dashboard (CVE‑2026‑27944) lets any remote actor request the /api/backup endpoint, retrieve a full server backup, and instantly decrypt it because the AES‑256 key and IV are leaked in the X‑Backup‑Security response header.
Exploitability – Public PoC code is available; the flaw is exploitable over the network without credentials. CVSS 9.8 (Critical).
Affected Products – Nginx UI (any version shipping the vulnerable /api/backup endpoint).
TPRM Impact – Third‑party services that expose Nginx UI to the internet (managed hosting, SaaS platforms, CDN providers) can inadvertently leak credentials, private TLS keys, and internal architecture details, creating a supply‑chain data‑exposure risk.
Recommended Actions –
- Immediately block public access to the Nginx UI and the
/api/backupendpoint (firewall/IP‑allowlist, VPN, zero‑trust). - Apply the vendor‑released patch or upgrade to a version where the endpoint is authenticated.
- Rotate all credentials, TLS private keys, and any secrets that may have been stored in backups.
- Conduct a forensic review of any backups taken since the last patch to confirm they do not contain exposed keys.
- Update third‑party risk assessments to reflect the new exposure vector and require vendors to demonstrate secure management‑plane controls.
Source: Security Affairs