Nginx UI: Missing OTP step-up check on cluster node and reload routes
Summary
Nginx UI 2.0.0 up to 2.4.x exposes cluster node management, namespace changes and cluster-wide nginx reload and restart through the api/cluster router. These routes require only a valid JWT and do not enforce the secure-session (OTP step-up) check that protects the single-node routes. An authenticated OTP-enabled user with a stolen or persisted JWT can therefore read and replace node credentials, change nodes and namespaces, and reload or restart nginx on all cluster nodes. This is an incomplete fix for CVE-2026-84315.
Affected
- Nginx UI (0xJacky/nginx-ui) versions 2.0.0 up to, but not including, 2.5.0
- Relevant only in cluster mode, through the api/cluster routes
Fixed in
- Fixed in version 2.5.0 (released by the vendor)
- Upgrade to 2.5.0 or later; the vendor's newer releases include this fix
Workaround
- No vendor workaround known; upgrading is the fix
- Restrict access to the admin interface (VPN, IP allowlist or reverse-proxy authentication)
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact
- No public proof of concept or known exploitation found at the time of writing
Our recommendation
- Upgrade Nginx UI to version 2.5.0 or later, and check for newer releases
- After upgrading, rotate the node secret and the application JWT secret so that previously issued JWTs become invalid
- Review administrator accounts, node configuration and access logs for unauthorized changes
- Do not expose the admin interface to the internet; enforce passkey or OTP for administrators
- Check the vendor's advisory list for follow-up advisories on the same step-up gap
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h246-wpgf-vmq5 github.com
- Fix commit a3999bd github.com
- Nginx UI release v2.5.0 github.com
- OSV entry GHSA-h246-wpgf-vmq5 osv.dev
- OSV entry CVE-2026-107813 osv.dev
- CVE-2026-107813 mirror record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:51.
Original description (NVD)
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.