Executive Summary

A critical vulnerability, CVE-2026-27944, has been identified in the Nginx UI management tool, posing a severe risk to users. The flaw, with a CVSS score of 9.8 (Critical), allows an unauthenticated attacker to download a complete system backup via an unprotected API endpoint. In a critical failure of security design, the same API response that provides the backup file also includes the key required to decrypt it. This allows an attacker to gain immediate access to the backup's contents, which may include administrator credentials, active session tokens, full Nginx configurations, and even SSL/TLS private keys. The IONIX research team, who reported the flaw, notes active exploitation attempts are underway, making immediate patching a top priority for all administrators using this tool.

Vulnerability Details

• CVE ID: CVE-2026-27944
• Affected Software: Nginx UI versions prior to 2.3.3
• Vulnerability Type: Information Disclosure via Missing Authentication
• CVSS Score: 9.8 (Critical)

The vulnerability exists in the /api/backup endpoint of the Nginx UI web interface. This endpoint lacks any authentication checks, allowing anyone on the network to access it.

Exploitation Process:

1. An unauthenticated attacker sends a GET request to https://<nginx-ui-host>/api/backup.
2. The server responds with a full, encrypted backup of the Nginx UI configuration.
3. Crucially, the server's response includes the X-Backup-Security HTTP header, which contains the plaintext key used to encrypt the backup.
4. The attacker uses the provided key to decrypt the backup file, gaining access to all its contents.

This is a textbook example of CWE-306: Missing Authentication for Critical Function combined with CWE-321: Use of Hard-coded Cryptographic Key (in this case, an easily disclosed key).

Affected Systems

Any server running Nginx UI versions prior to 2.3.3 with the web interface exposed to the network is vulnerable. This is particularly dangerous for internet-facing management interfaces.

Impact Assessment

The impact of exploiting this vulnerability is catastrophic. By decrypting the backup, an attacker can obtain:

• Administrator Credentials: Full administrative access to the Nginx UI.
• Session Tokens: The ability to hijack active administrative sessions.
• SSL/TLS Private Keys: Compromise of SSL keys allows for decryption of web traffic (Man-in-the-Middle attacks) and impersonation of the legitimate server.
• Full Nginx Configuration: Reveals the internal architecture, upstream servers, and security logic of the web applications being managed.

An attacker with this information could pivot to attack backend applications, intercept sensitive user data, or deface websites. The ease of exploitation (a single curl command) and the critical nature of the exposed data make this a top-tier threat.

Cyber Observables for Detection

Security teams should hunt for signs of exploitation by looking for unusual requests to the vulnerable endpoint.

Detection Methods

• Log Analysis: Create a SIEM rule to alert on any access to the /api/backup URL from an IP address not on an established allowlist of administrative hosts.
• Vulnerability Scanning: Use a vulnerability scanner to check for Nginx UI instances on your network and verify their version numbers.

Remediation Steps

1. Patch Immediately: The primary and most urgent action is to upgrade all Nginx UI instances to version 2.3.3 or later. This version correctly implements authentication on the /api/backup endpoint.
2. Restrict Access: As a best practice, the Nginx UI management interface should never be exposed to the public internet. Restrict access to a trusted internal network or require users to connect via a VPN with MFA.
3. Credential Rotation: If you suspect you may have been compromised, or even as a proactive measure, rotate all credentials stored or managed by Nginx UI. This includes administrator passwords and, most importantly, all SSL/TLS private keys. Revoke the old certificates and issue new ones.