CVE-2026-27944

🗓️ 05 Mar 2026 16:28:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 381 Views🌐 WEB

Unauthenticated access to /api/backup reveals keys in X-Backup-Security, enabling backup download.

Reporter	Title	Published	Views	Family All 51
GithubExploit	Exploit for CVE-2026-27944	10 Mar 202614:05	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui	3 Oct 202622:31	–	githubexploit
GithubExploit	Exploit for Missing Encryption of Sensitive Data in Nginxui Nginx_Ui	14 Mar 202602:43	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui	5 Jul 202610:59	–	githubexploit
GithubExploit	Exploit for CVE-2026-27944	10 Mar 202611:23	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui	18 Apr 202611:48	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui	7 May 202621:12	–	githubexploit
GithubExploit	Exploit for CVE-2026-27944	10 Mar 202615:14	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui	17 Apr 202610:41	–	githubexploit
GithubExploit	Exploit for Missing Encryption of Sensitive Data in Nginxui Nginx_Ui	14 Mar 202602:43	–	githubexploit

NVD

Vulners

Node

nginxui nginx_uiRange<2.3.3

[
  {
    "vendor": "0xJacky",
    "product": "nginx-ui",
    "versions": [
      {
        "version": "< 2.3.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762

Parameter	Position	Path	Description	CWE
node_secret	path	/mcp	Model Context Protocol (MCP) endpoint that can be used to open an unauthenticated SSE session to obtain a sessionID for further tool invocation.	CWE-306
sessionId	query param	/mcp_message	Unauthenticated endpoint that receives tool invocations via JSON-RPC, allowing for remote code execution or configuration modification.	CWE-306

17 Jun 2026 10:27Current

7.7High risk

Vulners AI Score7.7

CVSS 3.19.8

EPSS0.22842

SSVC

unauthenticated access backup endpoint encryption keys backup download nginx user interface