{"id":"EUVD-2026-17152","enisaUuid":"2e44fa9d-9064-3fec-87c5-1b4e07e5446b","description":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination. This issue has been patched in version 2.3.4.","datePublished":"Mar 30, 2026, 5:59:19 PM","dateUpdated":"Mar 30, 2026, 8:15:26 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m468-xcm6-fxg4\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4\n","aliases":"CVE-2026-33028\nGHSA-m468-xcm6-fxg4\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"7275798e-7057-3781-bcb4-f0b77756d928","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.3.4"}],"enisaIdVendor":[{"id":"f5f25e2e-0506-3f32-ba64-daa487cb8f21","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"2a0ed886-73a3-3452-aae1-c5c95456d472","vulnerability":{"id":"GHSA-m468-xcm6-fxg4","description":"nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse","datePublished":"Mar 30, 2026, 4:34:35 PM","dateUpdated":"Mar 30, 2026, 9:25:51 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m468-xcm6-fxg4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33028\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4\n","enisa_id":"EUVD-2026-17152\n","aliases":"GHSA-m468-xcm6-fxg4\nCVE-2026-33028\n","epss":0.0,"dataProcessed":"Nov 15, 2026, 2:48:45 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"396a0d3e-e810-353c-b618-3c0bacc24798","vulnerability":{"id":"CVE-2026-33028","description":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination. This issue has been patched in version 2.3.4.","datePublished":"Mar 30, 2026, 5:59:19 PM","dateUpdated":"Mar 30, 2026, 8:15:26 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m468-xcm6-fxg4\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4\n","enisa_id":"EUVD-2026-17152\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 15, 2026, 7:22:09 AM","vulnerabilityProduct":[{"id":"5fe3a3f0-bc7e-3385-aa03-fec975ad0fc1","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.3.4"}],"vulnerabilityVendor":[{"id":"0d05d57b-e080-3042-a7c3-e26411bf850e","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[{"id":"38a5893f-ec72-330f-af57-51916baa149b","advisory":{"id":"WID-SEC-W-2026-0931","description":"nginx-ui: Mehrere Schwachstellen","summary":"Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um sich Administratorrechte zu verschaffen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand herbeizuführen.","datePublished":"Mar 30, 2026, 10:00:00 PM","dateUpdated":"Apr 15, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0931.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-0931\n","aliases":"CVE-2026-33026\nCVE-2026-33027\nCVE-2026-33028\nCVE-2026-33029\nCVE-2026-33030\nCVE-2026-33032\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"241144ea-ade6-3239-9e33-0ffc0bce2924","product":{"name":"Nginx","vendor":{"name":"F5"}}},{"id":"e0b84173-9155-38db-a79a-0ad944ee9c6c","product":{"name":"UI 2.3.4","vendor":{"name":"Nginx"}}}]}}]}