CVE-2026-107811

Summary

Nginx UI allows authenticated users to access node management APIs that serialize node tokens, which can then be used to impersonate trusted nodes and bypass authentication for sensitive operations like configuration sync and service restarts.

Exploitability

Medium difficulty exploit requiring an authenticated user account with access to the affected APIs, leveraging the serialized node token to impersonate a trusted node within the cluster.

Blast radius

Affects all Nginx UI installations between versions 2.0.0 and 2.5.0 where authenticated users can reach the /api/nodes endpoints, potentially exposing cluster-wide management operations to unauthorized access.

Detection

Monitor for unusual API access patterns to /api/nodes and /api/nodes/:id endpoints with elevated privilege requests, particularly when node tokens are used in X-Node-Secret headers during authentication attempts.

Prioritized remediation

Upgrade to version 2.5.0 or later to fix the authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.