CVE-2026-34403
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.
How to fix
- nginxui nginx_ui2.3.5 or later
- github.com/0xJacky/Nginx-UI1.9.10-0.20260316053337-1a9cd29a3082 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nginxui nginx_ui | v < 2.3.5 | 2.3.5 |
| github.com/0xJacky/Nginx-UIGo | v < 1.9.10-0.20260316053337-1a9cd29a3082 | 1.9.10-0.20260316053337-1a9cd29a3082 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.