Skip to content
Fencer Vulns
high 8.8

CVE-2026-107807 json

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

published 2026-10-09 31 d ago modified 2026-10-20 20 d ago also EUVD-2026-95882 , GHSA-pvgv-gcp7-v38g , GO-2026-6708

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.

Patch / fix

  • go github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074433-a3999bd78a3b
  • nginxui nginx_ui 2.5.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
30 d ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/0xJacky/Nginx-UI
>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b
1.9.10-0.20260728074433-a3999bd78a3b

Affected products

  • 0xJacky nginx-ui

Classification

Weakness
  • CWE-312 Cleartext Storage of Sensitive Information
  • CWE-598 Use of HTTP Request With Sensitive Query String

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.