ZeroDay Findings
Sign inSign up

Findings

CVE-2026-42220

Nginx UI is a web user interface for the Nginx web server.

Published May 4, 2026 · updated Jun 17, 2026 · nginxui nginx ui

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 4, 2026 · NIST NVD

    Detected

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and a

  2. Jun 17, 2026 · NIST NVD

    Updated

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and a

Affected

  • cpe nginxui/nginx uiversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-42220

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-42220

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret hea

    nvd.nist.gov

References