Nginx UI: Node secret exposed via URL query parameter
Summary
Nginx UI, a web user interface for the Nginx web server, accepts the master node secret (Node.Secret) as the node_secret URL query parameter in HTTP and WebSocket authentication. Such URLs are recorded in access logs, proxy logs, browser history and Referer headers, and the cluster configuration embeds the secret in URLs stored in app.ini and environment variables. An attacker who obtains the secret bypasses password, JWT, session and two-factor checks and gains persistent administrative API access, including configuration and secret material. The attacker must first obtain the secret, for example by reading logs or configuration files; the CVSS vector assumes low privileges (PR:L).
Affected
- Nginx UI (0xJacky/nginx-ui) versions 2.0.0 up to, but not including, 2.5.0
- Cluster deployments that use node URLs with node_secret in app.ini or NGINX_UI_CLUSTER_NODE
Fixed in
- Nginx UI 2.5.0
- v2.5.1 is a hotfix that includes all changes from v2.5.0; the latest 2.5.x release is recommended
Workaround
No vendor workaround documented. Restrict network access to the Nginx UI interface and remove or restrict logs that contain node_secret until the update is applied.
Exploitation
- CISA SSVC data in the CVE record: exploitation 'poc', automatable: no, technical impact: total
- No evidence of active exploitation or a public proof of concept found in the research; CISA KEV status not verified directly
Our recommendation
- Upgrade to Nginx UI 2.5.0 or later, preferably the latest 2.5.x release
- After the upgrade, replace the node secret (NGINX_UI_NODE_SECRET) and the JwtSecret (NGINX_UI_APP_JWT_SECRET) and restart; in clusters, first confirm that node relationships show 'Paired signature'
- Rotate downstream credentials stored in Nginx UI, and review administrator accounts and access logs for unauthorized activity
- Search access, proxy and application logs for node_secret= and delete or restrict them
- Limit access to the Nginx UI interface to trusted networks
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pvgv-gcp7-v38g github.com
- Nginx UI release v2.5.0 github.com
- Nginx UI release v2.5.1 github.com
- Fix commit a3999bd78a3b97ab22e6b5e9fd478ac57598a954 github.com
- OSV entry CVE-2026-107807 osv.dev
- GitLab advisory CVE-2026-107807 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:52.
Original description (NVD)
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.