Vulnerability · Published May 4, 2026 · Assigned by GitHub_M

CVE-2026-42223nginx-ui: Settings API Exposes Protected Secrets

Medium 6.5

In plain English

A medium-severity information exposure in nginx-ui from 0xJacky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag is only enforced during writes (via ProtectedFill in SaveSettings) and is completely ignored during reads. This exposes 40+ protected fields including JwtSecret (enabling auth token forgery), NodeSecret (enabling cluster node impersonation), OIDC ClientSecret (enabling OAuth account takeover), and the IP whitelist configuration. This issue has been patched in version 2.3.8.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/0xJacky/nginx-ui	2.3.8	GHSA-q4w7-56hr-83rm
Go	github.com/0xJacky/nginx-ui	no fix listed	GO-2026-5565

Affected products (as reported)

Vendor	Product	Versions
0xJacky	nginx-ui	< 2.3.8

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-q4w7-56hr-83rm x_refsource_CONFIRM
https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8 x_refsource_MISC