266020 matches found
EUVD-2026-95895
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...
CVE-2026-107811 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...
CVE-2026-107811
The Nginx UI web interface for the Nginx web server is vulnerable in versions 2.0.0 through 2.5.0 . Authenticated users can access the /api/nodes and /api/nodes/:id endpoints, which serialize and leak the node token field. An attacker can use this token as the X-Node-Secret header to bypass authe...
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: kueue-fips, vault-secrets-webhook, crossplane-provider-aws-resourcegroups-fips, crossplane-provider-aws-route53resolver-fips, crossplane-provider-aws-fsx, kiam, crossplane-provider-aws-kafkaconnect, ceph-csi-operator-fips, nrdot-collector, kro-fips,...
GO-2026-6611 vulnerabilities
Vulnerabilities for packages: kueue-fips, vault-secrets-webhook, mc, crossplane-provider-aws-resourcegroups-fips, opa, crossplane-provider-aws-route53resolver-fips, crossplane-provider-aws-fsx, ferretdb, kiam, crossplane-provider-aws-kafkaconnect, ceph-csi-operator-fips, nrdot-collector, kro-fips...
GO-2026-6617 vulnerabilities
Vulnerabilities for packages: kueue-fips, vault-secrets-webhook, mc, crossplane-provider-aws-resourcegroups-fips, opa, crossplane-provider-aws-route53resolver-fips, crossplane-provider-aws-fsx, ferretdb, kiam, crossplane-provider-aws-kafkaconnect, ceph-csi-operator-fips, nrdot-collector, kro-fips...
GO-2026-6603 vulnerabilities
Vulnerabilities for packages: kueue-fips, vault-secrets-webhook, mc, crossplane-provider-aws-resourcegroups-fips, opa, crossplane-provider-aws-route53resolver-fips, crossplane-provider-aws-fsx, ferretdb, kiam, crossplane-provider-aws-kafkaconnect, ceph-csi-operator-fips, nrdot-collector, kro-fips...
CVE-2026-78669 vulnerabilities
Vulnerabilities for packages: kueue-fips, vault-secrets-webhook, mc, crossplane-provider-aws-resourcegroups-fips, opa, crossplane-provider-aws-route53resolver-fips, crossplane-provider-aws-fsx, ferretdb, kiam, crossplane-provider-aws-kafkaconnect, ceph-csi-operator-fips, nrdot-collector, kro-fips...
GO-2026-6612 vulnerabilities
Vulnerabilities for packages: kueue-fips, vault-secrets-webhook, mc, crossplane-provider-aws-resourcegroups-fips, opa, crossplane-provider-aws-route53resolver-fips, crossplane-provider-aws-fsx, ferretdb, kiam, crossplane-provider-aws-kafkaconnect, ceph-csi-operator-fips, nrdot-collector, kro-fips...
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-route53, rclone, victoriametrics-operator, steampipe, cert-manager-istio-csr, vault-env, falcosidekick, boring-registry, continuity, task, crossplane-provider-aws-lambda, nri-elasticsearch, kaf, azure-service-operator, juicefs-csi-driver, dex,...
GO-2026-6617 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-route53, rclone, sftpgo-plugin-eventstore, victoriametrics-operator, steampipe, cert-manager-istio-csr, vault-env, buildkitd, harbor, falcosidekick, boring-registry, continuity, skopeo, task, crossplane-provider-aws-lambda, nri-elasticsearch,...
CVE-2026-97032 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-route53, rclone, sftpgo-plugin-eventstore, victoriametrics-operator, steampipe, cert-manager-istio-csr, vault-env, buildkitd, harbor, falcosidekick, boring-registry, continuity, skopeo, task, crossplane-provider-aws-lambda, nri-elasticsearch,...
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
EUVD-2026-95818
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
CVE-2026-107805 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
CVE-2026-107805 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
CVE-2026-107805
The Nginx UI web user interface is vulnerable to a resource exhaustion flaw in versions 2.5.0 through 2.6.0 . The root cause lies in the node-signature authentication path , which stages an attacker-controlled request body into a temporary file and synchronizes it before validating the cryptograp...