GHSA-H246-WPGF-VMQ5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

PT-2026-110788

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description Nginx UI fails to apply RequireSecureSession to several authenticated mutation routes. This occurs despite the requirement for users with One-Time Password OTP enabled to provide a fresh...