CVE-2026-42223

MEDIUM 6.5

nginx-ui: Settings API Exposes Protected Secrets

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag is only enforced during writes (via ProtectedFill in SaveSettings) and is completely ignored during reads. This exposes 40+ protected fields including JwtSecret (enabling auth token forgery), NodeSecret (enabling cluster node impersonation), OIDC ClientSecret (enabling OAuth account takeover), and the IP whitelist configuration. This issue has been patched in version 2.3.8.

CWE	CWE-200
Vendor	0xjacky
Product	nginx-ui
Published	May 4, 2026

Stay Ahead of the Next One

Get instant alerts for 0xjacky nginx-ui

Be the first to know when new medium vulnerabilities affecting 0xjacky nginx-ui are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

0xJacky / nginx-ui

< 2.3.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-q4w7-56hr-83rm github.com: https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8