Nginx UI: Missing OTP step-up on sensitive mutation routes
Summary
Nginx UI, a web interface for managing the Nginx web server, does not enforce the OTP or passkey step-up check (RequireSecureSession) on several authenticated routes that change backups, DNS credentials, certificates, Nginx settings and site or stream configurations. An attacker who holds a stolen authenticated session can perform these sensitive changes without the second factor. The vendor fixed the issue in version 2.4.1, but a follow-up advisory (CVE-2026-107813) reports that a parallel router was missed, so the fix may be incomplete.
Affected
- Nginx UI versions before 2.4.1
- The exact affected version range is inconsistent across sources; use 2.4.1 as the reference and check the installed version in the UI or binary
Fixed in
- Version 2.4.1 (vendor release)
- The follow-up advisory CVE-2026-107813 reports a router not covered by the 2.4.1 fix; the fixed version for that issue could not be confirmed from a primary source. Unknown.
Workaround
- No vendor workaround documented.
- Restrict access to the Nginx UI admin interface to a management network or VPN.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV according to trackers.
- No public proof of concept found in primary sources; PoC status is unverified.
- CISA SSVC: exploitation poc, automatable no, technical impact partial.
Our recommendation
- Update Nginx UI to 2.4.1 or later, and verify that the follow-up fix for CVE-2026-107813 is also included in the newest release.
- Restrict the admin interface to an internal management network or VPN and do not expose it to the internet.
- Revoke active sessions and tokens after patching.
- Enable OTP or passkeys for all admin accounts.
- Review audit logs for unexpected changes to backups, certificates, DNS credentials and reloads.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-84315 at OpenCVE app.opencve.io
- GitHub Security Advisory GHSA-5v7c-xpfp-p65m github.com
- Nginx UI release v2.4.1 github.com
- Fix commit 23d1934 github.com
- OSV CVE-2026-84315 osv.dev
- GitLab advisory CVE-2026-84315 advisories.gitlab.com
- GitLab advisory CVE-2026-107813 (follow-up) advisories.gitlab.com
- CVE record (CVE List V5) raw.githubusercontent.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:55.
Original description (NVD)
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.