| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
Known vulnerabilities affecting Nginx products and systems
| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
| CVE-2026-4342 | A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of ... | 8.8 | 630 | Neutral | No |
| Yes |
| CVE-2026-42238 | **Product:** nginx-ui **Repository:** `0xJacky/nginx-ui` (branch: `dev`) **Vulnerability Class:** Authentication Bypass → Arbitrary File Write → OS Command Injection **Affected Component:** `POST /api... | 9.8 | 751 | Neutral | No | Yes |
| CVE-2026-42223 | ### Summary The `GetSettings` API handler (`api/settings/settings.go:24-65`) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with `pro... | 6.5 | 273 | Neutral | No | Yes |
| CVE-2026-42222 | ## Summary An unauthenticated bootstrap takeover exists in `nginx-ui` during the initial installation window exposed by `POST /api/install`. When the instance is still uninitialized, `POST /api/inst... | 9.8 | 717 | Neutral | No | Yes |
| CVE-2026-42221 | ### Summary An unauthenticated network attacker can claim the initial administrator account on a fresh `nginx-ui` instance during the first-run setup window. The public `/api/install` endpoint is reac... | 9.8 | 717 | Neutral | No | Yes |
| CVE-2026-42220 | ## Summary An authenticated user can call `GET /api/settings` and retrieve sensitive configuration values, including `node.secret`. The same `node.secret` is accepted by `AuthRequired()` through the `... | 6.5 | 273 | Neutral | No | Yes |
| CVE-2026-34403 | ## Summary All WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fac... | 8.1 | 540 | Neutral | No | Yes |
| CVE-2026-33032 | ### Summary The nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: `/mcp` and `/mcp_message`. While `/mcp` requires both IP whitelisting and authentication (`AuthRequired()`... | 9.8 | 819 | Low | Yes | Yes |
| CVE-2026-33031 | ### Summary A user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate tha... | 8.1 | 540 | Neutral | No | Yes |
| CVE-2026-33030 | ## Summary Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The applicat... | 9.9 | 748 | Neutral | No | Yes |
| CVE-2026-33029 | ### Summary An input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation... | 6.5 | 295 | Neutral | No | Yes |
| CVE-2026-33028 | ### Summary The `nginx-ui` application is vulnerable to a **Race Condition**. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to ... | 7.5 | 379 | Neutral | No | Yes |
| CVE-2026-33027 | ## Summary The nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory... | 6.5 | 331 | Neutral | No | Yes |
| CVE-2026-33026 | ## Summary The `nginx-ui` backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. ## Details The backup format lacks ... | 9.1 | 558 | Neutral | No | Yes |
| CVE-2026-3288 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary co... | 8.8 | 740 | Neutral | Yes | No |
| CVE-2026-32647 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting ... | 7.8 | 517 | Neutral | No | Yes |
| CVE-2026-28755 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocs... | 5.4 | 185 | Neutral | No | Yes |
| CVE-2026-28753 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server ... | 3.7 | 102 | Neutral | No | Yes |
| CVE-2026-27944 | ## Summary The `/api/backup` endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the `X-Backup-Security` response header. This allows an ... | 9.8 | 819 | Low | Yes | Yes |
| CVE-2026-27784 | The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its term... | 5.5 | 125 | Neutral | No | Yes |