CVE-2026-27944

Published Mar 5, 2026

Last updated 3 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-27944 is an authentication bypass and information disclosure vulnerability affecting Nginx UI, a web user interface for the Nginx web server, in versions prior to 2.3.3. The vulnerability stems from the `/api/backup` endpoint being accessible without requiring any authentication. Compounding this issue, the encryption keys necessary to decrypt the downloaded backup are disclosed within the `X-Backup-Security` response header. This allows an unauthenticated attacker to download a complete system backup, which can contain sensitive data such as user credentials, session tokens, SSL private keys, and Nginx configurations, and then immediately decrypt it.

Description: Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.
Source: security-advisories@github.com
NVD status: Analyzed
Products: nginx_ui

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AA731011-DD7D-446C-99D7-120A6EBDD668",
            "versionEndExcluding": "2.3.3",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.