Live › vulnerability › CVE-2026-107811
Go to dashboardAny logged-in user of Nginx UI can call /api/nodes and /api/nodes/:id, which return each cluster node's token. That token can be sent as X-Node-Secret to act as a trusted node, letting an attacker run cluster operations such as config sync and service restart on other members.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b | 1.9.10-0.20260728091109-0ecbd106c37b |
Check the go.mod of projects that depend on github.com/0xJacky/Nginx-UI for a version in the affected range. unknown for a runtime check in the sources.
Upgrade github.com/0xJacky/Nginx-UI to 2.5.0 or pseudo-version 1.9.10-0.20260728091109-0ecbd106c37b, then rotate node tokens.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107811")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.