Cross-Site WebSocket Hijacking Vulnerability in Nginx UI by Nginx

CVE-2026-34403

What is CVE-2026-34403?

Nginx UI, a web user interface for managing Nginx, had an important security flaw prior to version 2.3.5. All WebSocket endpoints in affected versions utilized a gorilla/websocket Upgrader that accepted requests from any origin without proper validation. This created a pathway for attackers to exploit using authenticated connections. Furthermore, authentication tokens saved in browser cookies lacked the HttpOnly and SameSite attributes, complicating the security posture during user sessions. If a logged-in administrator inadvertently visited a malicious site, attackers could hijack authenticated WebSocket connections to the Nginx UI instance. The vulnerability has been addressed in version 2.3.5, which ensures stronger security features to prevent unauthorized access.

References