CVE-2026-107813

Summary

Nginx UI allows authenticated users with stolen JWT tokens to perform critical cluster operations without requiring a second-factor authentication step, enabling unauthorized node management and Nginx reloads/restarts. This represents a significant privilege escalation vulnerability where attackers can bypass secure session requirements.

Exploitability

Exploitation is moderately easy for an attacker who has obtained a valid JWT token from an OTP-enabled user, requiring only the ability to make authenticated API requests to the affected endpoints without needing fresh second-factor authentication.

Blast radius

The impact could be severe across multiple Nginx nodes, allowing attackers to modify configurations, reload or restart services, potentially causing service disruption or enabling further attacks through compromised node credentials.

Detection

Monitor for unauthorized API calls to /api/cluster/nodes/reload_nginx and /api/cluster/nodes/restart_nginx endpoints with valid JWT tokens that lack fresh second-factor authentication, particularly when these operations occur outside normal maintenance windows.

Prioritized remediation

Upgrade to version 2.5.0 or later to address this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.