by Kastro
Paper/Archive/CVE-2026-27944

CVE-2026-27944

0xJacky nginx-ui — Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

EPSS 23%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.7.977 × 2019.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.

Affected

ProductAffectedFixed inSource
nginx-ui< 2.3.3–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762