Cross-Node Authentication Bypass Vulnerability in Nginx UI by Nginx

CVE-2026-107811

What is CVE-2026-107811?

The Nginx UI, a web interface for the Nginx web server, contains a cross-node authentication bypass vulnerability affecting versions 2.0.0 through 2.5.0. Authenticated users can exploit this flaw by accessing certain API endpoints that reveal sensitive node token information. This exposure allows malicious users to impersonate trusted nodes within the cluster, granting them unauthorized access to sensitive operations like configuration synchronization and service restarts. The issue has been resolved in version 2.5.0, and users are urged to upgrade to mitigate these risks.

References