PT-2026-36923 · Nginx-Ui · Nginx-Ui

Yotampe-Pluto · Published 2026-04-21 · Updated 2026-05-06 · CVE-2026-42223

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.8

Description The GetSettings API handler in the api/settings/settings.go file serializes all settings structs to JSON and returns them to authenticated users. While many sensitive fields are marked as protected, this restriction is only applied during write operations via the SaveSettings function and is ignored during read operations. This results in the exposure of over 40 protected fields, including JwtSecret, which allows for authentication token forgery; NodeSecret, which enables cluster node impersonation; OIDC ClientSecret, which allows for OAuth account takeover; and the IP whitelist configuration.

Recommendations Update to version 2.3.8.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-06344

CVE-2026-42223

GHSA-Q4W7-56HR-83RM

Affected Products

Nginx-Ui

References · 11

• 🔥 https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-q4w7-56hr-83rm · Exploit
• https://osv.dev/vulnerability/GHSA-q4w7-56hr-83rm · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06344 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42223 · Security Note
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8 · Note
• https://github.com/0xJacky/nginx-ui · Note
• https://t.me/CVEtracker/52679 · Telegram Post
• https://t.me/cveNotify/162371 · Telegram Post
• https://twitter.com/infoflowcloud/status/2051405508481790184 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051477892090007750 · Twitter Post
• https://twitter.com/CVEnew/status/2051403814188483050 · Twitter Post