Authenticated Node CRUD and Nginx Restart in Nginx UI

Executive Summary

CVE-2026-107813 is a vulnerability in Nginx UI versions 2.0.0 to 2.5.0 where the api/cluster router allows sensitive operations like node management and nginx reload/restart with only a JWT. This happens because the router lacks a RequireSecureSession requirement, meaning an attacker with a stolen or persisted JWT can perform these actions without a second-factor step-up.

Useful 0 Not Useful 0

Detection Guidance

Check if your nginx-ui version is between 2.0.0 and 2.5.0. Review audit logs for unauthorized cluster operations like node CRUD, namespace changes, or nginx reload/restart commands without a fresh OTP step-up. Look for JWT tokens in logs that were used for sensitive actions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to perform unauthorized node CRUD operations, read or replace node credentials, change namespaces, and trigger nginx reload or restart. This could lead to unauthorized access, data breaches, configuration changes, or service disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance due to potential data breaches and lack of proper access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade nginx-ui to version 2.5.0 or later. Apply RequireSecureSession middleware to the api/cluster router's mutation handlers. Review and update other handlers like system/restart and core-upgrade for similar issues. Rotate all node secrets and JWT tokens if they may have been exposed.

Useful 0 Not Useful 0