CVE-2026-27944 - Vulnerability Analysis

Overview

Nginx UI < 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups.

Severity & Score

Impact

Unauthenticated attackers can access and decrypt full system backups, exposing sensitive data including credentials and private keys.

Mitigation

Upgrade to version 2.3.3 or later.

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762

Social Media Activity(1 post)

Patrick C Miller :donor:

@patrickcmiller

Mar 10, 2026

Critical Nginx UI flaw CVE-2026-27944 exposes server backups https://securityaffairs.com/189123/security/critical-nginx-ui-flaw-cve-2026-27944-exposes-server-backups.html

View original post

GitHub Repositories(3 repos)

• https://github.com/weefunker/CVE-2026-27944-Lab
• https://github.com/NULL200OK/CVE-2026-27944
• https://github.com/NULL200OK/-nginxui_discover

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner