CVE-2026-107805

Summary

Nginx UI's node-signature authentication allows unauthenticated attackers to consume system resources through temporary file staging, leading to availability degradation without compromising confidentiality or integrity. This is a resource exhaustion vulnerability that can be exploited remotely.

Exploitability

Exploitation is relatively straightforward for any remote attacker who can reach the API endpoint and provide syntactically valid signature metadata, requiring no authentication or special privileges.

Blast radius

The impact could affect all Nginx UI instances running versions 2.5.0 through 2.6.0, potentially causing service unavailability or degraded performance for legitimate users.

Detection

Monitor for unusual disk I/O patterns and temporary file creation in the Nginx UI application directory, particularly around the authentication endpoint, as attackers may create multiple temporary files during signature validation attempts.

Prioritized remediation

Upgrade to version 2.6.0 or later to fix the resource exhaustion vulnerability in node-signature authentication.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.