CVE-2026-107813
Description
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.
How to fix
- nginxui nginx_ui2.5.0 or later
- github.com/0xJacky/Nginx-UI1.9.10-0.20260728074433-a3999bd78a3b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nginxui nginx_ui | 2.0.0 ≤ v < 2.5.0 | 2.5.0 |
| github.com/0xJacky/Nginx-UIGo | 1.9.10-0.20250517140552-daee3ac7ade1 ≤ v < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.