CVE-2026-42220 - Vulnerability Analysis

Overview

Nginx UI < 2.3.8 contains an information disclosure caused by authenticated users retrieving sensitive configuration values including node.secret via GET /api/settings, letting attackers authenticate as init user via trusted-node path, exploit requires user authentication.

Severity & Score

Impact

Authenticated users can retrieve sensitive secrets and authenticate as init user, leading to full privileged access.

Mitigation

Upgrade to version 2.3.8 or later.

References

• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-7jrr-xw9c-mj39

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner