{"id":"CVE-2026-107807","kind":"vulnerability","aliases":["CVE-2026-107807","GHSA-pvgv-gcp7-v38g","GO-2026-6708"],"related":[],"title":"Nginx UI: Node Secret Credential Exposure via URL Query Parameter in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.","summary":"Nginx UI, a web interface for managing Nginx, accepts the node secret master credential in the node_secret URL query parameter for HTTP and WebSocket authentication. Anyone who obtains that secret from logs, browser history or Referer headers can bypass password, JWT, session and second-factor checks and gain persistent admin API access, including configuration and secret material.","severity":"high","cvss":8.8,"epss":0.00296,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260728074433-a3999bd78a3b"],"affected":">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod and confirm it is at or above 1.9.10-0.20260728074433-a3999bd78a3b.\nSearch proxy and access logs for 'node_secret=' to see whether the secret has already appeared in URLs.","fix":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074433-a3999bd78a3b or later (the description cites fixed version 2.5.0).\nRotate the Node.Secret after upgrading, since it may already be exposed in logs.","status":"open","published_at":"2026-10-09T16:17:25+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:38+00:00","updated_at":"2026-10-23T19:52:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:52:38Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074433-a3999bd78a3b or later (the description cites fixed version 2.5.0).\nRotate the Node.Secret after upgrading, since it may already be exposed in logs.","summary":"Nginx UI, a web interface for managing Nginx, accepts the node secret master credential in the node_secret URL query parameter for HTTP and WebSocket authentication. Anyone who obtains that secret from logs, browser history or Referer headers can bypass password, JWT, session and second-factor checks and gain persistent admin API access, including configuration and secret material.","category":"package","who_cares":["nginx-ui","self-hosted","go","nginx"],"confidence":0.7,"analyst_note":"Sources list fixed version 1.9.10-0.20260728074433-a3999bd78a3b but the description says fixed in 2.5.0; confirm the correct release and whether node_secret was used in deployments at https://pkg.go.dev/vuln/GO-2026-6708.","how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod and confirm it is at or above 1.9.10-0.20260728074433-a3999bd78a3b.\nSearch proxy and access logs for 'node_secret=' to see whether the secret has already appeared in URLs.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"severity_if_unknown":"high"},"cost_usd":0.000493,"input_tokens":2335,"output_tokens":519,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107807':17A,28A '-2026':16A,24A,27A '-6708':25A '/0xjacky/nginx-ui':14A,31A '2.0.0':113C '2.5.0':115C,200C 'accept':49B,118C 'access':94B,150C,186C,188C 'admin':92B 'administr':184C 'anyon':67B 'api':93B,185C 'appear':148C 'authent':66B,133C 'browser':74B,154C 'bypass':80B,171C 'check':88B,180C 'configur':96B,158C,190C 'consequ':147C 'credenti':5A,54B,122C,145C 'cve':15A,26A 'data':163C 'deploy':161C 'environ':162C 'exposur':6A 'factor':87B,179C 'fix':197C 'gain':90B 'gcp7':21A 'ghsa':19A 'ghsa-pvgv-gcp7-v38g':18A 'github.com':13A,30A 'github.com/0xjacky/nginx-ui':12A,29A 'go':23A,32B 'header':78B,143C,157C 'histori':75B,155C 'host':40B 'http':63B,130C 'includ':95B,187C 'instead':135C 'interfac':45B,106C 'issu':195C 'jwt':82B,174C 'log':73B,151C,153C 'manag':47B 'master':53B,121C 'materi':99B,193C 'nginx':1A,33B,35B,41B,48B,100C,109C,116C 'nginx-ui':34B 'node':3A,51B,57B,125C,141C 'node.secret':120C 'normal':172C 'obtain':69B,167C,182C 'packag':37B 'paramet':10A,61B,128C 'parti':165C 'password':81B,173C 'path':134C 'persist':91B,183C 'proxi':152C 'pvgv':20A 'queri':9A,60B,127C 'refer':77B,156C 'requir':137C 'second':86B,178C 'second-factor':85B,177C 'secret':4A,52B,58B,71B,98B,126C,142C,169C,192C 'self':39B 'self-host':38B 'server':111C 'session':83B,175C 'ui':2A,36B,42B,101C,117C 'url':8A,59B,159C 'user':105C 'v38g':22A 'version':199C 'via':7A 'web':44B,104C,110C 'websocket':65B,132C 'x':140C 'x-node-secret':139C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T16:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6708","url":"https://pkg.go.dev/vuln/GO-2026-6708","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107807","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107807","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107807","severity":null,"published_at":"2026-10-09T16:17:25+00:00","modified_at":"2026-10-20T15:27:19+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}