Nginx UI

A security flaw tracked as CVE-2026-107806 has been disclosed in Nginx UI, the web interface for Nginx by developer 0xJacky. A logged-in user can abuse the backup restore endpoint to overwrite configuration and execute commands on the server. Versions 2.3.8 through before 2.5.0 are affected, and the issue is fixed in version 2.5.0. Administrators running the panel are being urged to upgrade promptly.

A high-severity flaw, CVE-2026-107809 rated 8.8, has been disclosed in Nginx UI, the web interface for the Nginx server. Versions 2.0.0 through before 2.5.0 accept a browser-managed token cookie as an API credential after the front end stores the JWT there, leaving management endpoints exposed. Security communities are sharing the advisory and urging users to update to 2.5.0 or later.

A new high-severity vulnerability, CVE-2026-107808 with a CVSS score of 8.1, has been disclosed in Nginx UI, the web management interface for the Nginx web server. Versions 2.0.0 through 2.5.0 fail to properly enforce passkey authentication: the login endpoint checks whether OTP is enabled but does not require a WebAuthn assertion when passkeys are enabled and no TOTP secret is configured, potentially allowing passkey-only accounts to bypass authentication. Security teams are urged to update to version 2.5.0 or later.

A new vulnerability, CVE-2026-107807, has been assigned a high severity score of 8.8. It affects Nginx UI, a web interface for managing the Nginx web server, in versions 2.0.0 through 2.5.0. The flaw involves the software accepting the Node.Secret master credential via the node_secret query parameter in HTTP and WebSocket authentication paths, rather than requiring it through a more secure channel, exposing credentials to interception. Administrators running affected versions are urged to review the advisory and update promptly.