{"id":"CVE-2026-107811","kind":"vulnerability","aliases":["CVE-2026-107811","GHSA-32gc-wf3m-78w9","GO-2026-6702"],"related":[],"title":"0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.","summary":"Any logged-in user of Nginx UI can call /api/nodes and /api/nodes/:id, which return each cluster node's token. That token can be sent as X-Node-Secret to act as a trusted node, letting an attacker run cluster operations such as config sync and service restart on other members.","severity":"high","cvss":8.8,"epss":0.00357,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260728091109-0ecbd106c37b"],"affected":">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b","ecosystem":"go"}],"ecosystems":["go"],"tags":["cluster-mode","go","nginx-ui","package"],"not_affected_if":["no-authenticated-users-beyond-admin","single-node-deployment"],"how_to_check":"Check the go.mod of projects that depend on github.com/0xJacky/Nginx-UI for a version in the affected range. unknown for a runtime check in the sources.","fix":"Upgrade github.com/0xJacky/Nginx-UI to 2.5.0 or pseudo-version 1.9.10-0.20260728091109-0ecbd106c37b, then rotate node tokens.","status":"open","published_at":"2026-10-09T16:17:25+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:51:28+00:00","updated_at":"2026-10-23T19:51:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T19:51:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/0xJacky/Nginx-UI to 2.5.0 or pseudo-version 1.9.10-0.20260728091109-0ecbd106c37b, then rotate node tokens.","summary":"Any logged-in user of Nginx UI can call /api/nodes and /api/nodes/:id, which return each cluster node's token. That token can be sent as X-Node-Secret to act as a trusted node, letting an attacker run cluster operations such as config sync and service restart on other members.","category":"package","who_cares":["nginx-ui","go","cluster-mode"],"confidence":0.6,"analyst_note":"Sources conflict on the affected range: the description says 2.0.0 to 2.5.0 while the product entry says >= 1.9.10-0.20250517140552-daee3ac7ade1 and < 1.9.10-0.20260728091109-0ecbd106c37b; confirm against https://pkg.go.dev/vuln/GO-2026-6702 and the GHSA.","how_to_check":"Check the go.mod of projects that depend on github.com/0xJacky/Nginx-UI for a version in the affected range. unknown for a runtime check in the sources.","needs_analyst":true,"not_affected_if":["single-node-deployment","no-authenticated-users-beyond-admin"],"severity_if_unknown":"unknown"},"cost_usd":0.000645,"input_tokens":2330,"output_tokens":824,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107811':21A,32A '-2026':20A,28A,31A '-6702':29A '/0xjacky/nginx-ui':18A,35A '/api/nodes':2A,54B,56B,118C,120C '0xjacky/nginx-ui':1A '2.0.0':110C '2.5.0':112C,183C '32gc':24A '78w9':26A 'accept':133C 'access':117C 'act':76B 'allow':8A,147C 'attack':83B 'authent':114C,164C 'authrequir':140C 'bypass':165C 'call':53B 'cluster':4A,37B,61B,85B,158C 'cluster-mod':36B 'config':89B 'configur':172C 'cross':10A,162C 'cross-nod':9A,161C 'cve':19A,30A 'expos':167C 'field':128C 'fix':180C 'ghsa':23A 'ghsa-32gc-wf3m-78w9':22A 'github.com':17A,34A 'github.com/0xjacky/nginx-ui':16A,33A 'go':27A,39B 'id':57B,121C 'imperson':12A,151C 'includ':171C 'initus':14A,146C 'interfac':103C 'issu':178C 'leak':3A 'let':81B 'log':46B 'logged-in':45B 'manag':169C 'map':142C 'member':96B,159C 'mode':38B 'nginx':41B,50B,97C,106C 'nginx-ui':40B 'node':5A,11A,62B,73B,80B,126C,137C,154C,163C 'oper':86B,170C 'ordinari':113C 'packag':43B 'reachabl':157C 'request':144C 'respons':123C 'restart':93B,176C 'return':59B 'run':84B 'secret':74B,138C 'sensit':168C 'sent':69B 'serial':124C 'server':108C 'servic':92B,175C 'sync':90B 'synchron':173C 'token':6A,64B,66B,127C,131C 'trust':79B,153C 'ui':42B,51B,98C 'user':48B,102C,115C,149C 'version':182C 'web':101C,107C 'wf3m':25A 'whose':122C 'x':72B,136C 'x-node-secret':71B,135C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T16:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6702","url":"https://pkg.go.dev/vuln/GO-2026-6702","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107811","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107811","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107811","severity":null,"published_at":"2026-10-09T16:17:25+00:00","modified_at":"2026-10-20T15:07:24+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}