Nginx UI Auth Bypass Allows JWT-Only Cluster Control in High-Severity CVE-2026-107813
An incomplete patch in Nginx UI allows attackers with valid tokens to manage cluster nodes and restart services without re-authenticating via second factor.
Key points
- CVE-2026-107813 is rated High severity with a CVSS score of 8.8.
- The flaw affects Nginx UI versions 2.0.0 through 2.5.0.
- Attackers can perform node CRUD and trigger cluster-wide reloads using only a JWT.
Nginx UI, a web interface for managing the Nginx web server, contains a high-severity authentication bypass vulnerability. The defect allows authenticated users to perform sensitive cluster operations without completing a required one-time password (OTP) step-up. This issue stems from an incomplete remediation of a previous security flaw, leaving critical administrative endpoints exposed to token-based attacks.
Root cause
The vulnerability arises from inconsistent application of security middleware across different API routers. A prior fix added a `RequireSecureSession` check to mutation handlers for nginx, certificates, DNS, backups, sites, and streams. However, this safeguard was not applied to the separate `api/cluster` router. Consequently, operations within the cluster module remain protected only by standard JWT authentication, lacking the additional layer of OTP verification required for sensitive actions.
Attack path
An attacker who obtains or persists a valid JWT for an OTP-enabled user can exploit this gap. Because the `api/cluster` router does not enforce a fresh secure session, the attacker can execute node creation, editing, and deletion. They can also read or replace node credentials, modify namespaces, and invoke cluster-wide Nginx reload or restart commands. This enables full control over cluster configuration and service availability without needing the second factor.
Affected versions
- Nginx UI versions 2.0.0 through 2.5.0 are vulnerable.
- The specific Go module `github.com/0xJacky/Nginx-UI` is affected from version 1.9.10-0.20250517140552-daee3ac7ade1 up to, but not including, the patched release.
Mitigation
- Upgrade Nginx UI to version 2.5.0 or later immediately.
- Rotate all node credentials and JWT secrets if exposure is suspected.
- Monitor cluster logs for unauthorized node modifications or unexpected reload events.
- Review access controls to ensure all sensitive API endpoints enforce step-up authentication.
What to do and how to stay safe: Nginx UI
- Audit all administrative interfaces to ensure consistent authentication requirements across all API endpoints.
- Implement strict monitoring for unusual cluster configuration changes or service restarts.
- Rotate API tokens and secrets regularly to limit the window of opportunity for stolen credentials.
- Verify that security patches address all related components and routers, not just the primary module.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107813?
It is a high-severity vulnerability in Nginx UI where the cluster API bypasses OTP step-up authentication, allowing token-based access to sensitive operations.
Which versions of Nginx UI are affected?
Versions 2.0.0 through 2.5.0 are affected by this incomplete fix.
Is there a fix available?
Yes, the issue is fixed in Nginx UI version 2.5.0.
