Node.Secret Credential Exposure in Nginx UI Versions 2.0.0 to 2.5.0

CVE-2026-107807

What is CVE-2026-107807?

Nginx UI, a web user interface for managing the Nginx web server, contains a vulnerability that allows the Node.Secret master credential to be passed through the node_secret query parameter. This flaw is found in versions 2.0.0 through 2.5.0 and puts sensitive credentials at risk of exposure in various logs, browser histories, and environment configurations. An attacker with access to the leaked secret can skip standard authentication mechanisms, gaining unauthorized administrative API access and compromising sensitive configurations. The vulnerability has been addressed in version 2.5.0.

References