CSRF Vulnerability in Nginx UI Web Interface by Nginx

CVE-2026-107809

What is CVE-2026-107809?

Nginx UI, a web user interface for managing the Nginx web server, exhibits a CSRF vulnerability in versions 2.0.0 through 2.5.0. This flaw arises as AuthRequired accepts a browser-managed token cookie as an API credential without adequately enforcing CSRF protection or validating Origin or Referer headers. As a result, a remote attacker could leverage this weakness to induce actions in an authenticated administrator's browser, enabling them to perform state-changing requests such as modifying configurations or triggering reloads. The exploit necessitates that the attacker have an administrator account without an OTP/Passkey setup or interact with a vulnerable endpoint lacking secure-session requirements. The vulnerability has been addressed in version 2.5.0.

References