{"id":"EUVD-2026-27133","enisaUuid":"7e249273-9b70-36b7-be8a-4d3ed94f5ce9","description":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.","datePublished":"May 4, 2026, 8:08:07 PM","dateUpdated":"May 6, 2026, 12:26:14 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-7jrr-xw9c-mj39\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8\n","aliases":"CVE-2026-42220\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"941c5ea7-c23f-3f9d-ac22-788261b3e1f7","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.3.8"}],"enisaIdVendor":[{"id":"8ba02240-7781-3c95-91ba-8ca5416dcb7f","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"22a325cd-9382-366c-b8bb-20e6323d6628","vulnerability":{"id":"CVE-2026-42220","description":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.","datePublished":"May 4, 2026, 8:08:07 PM","dateUpdated":"May 6, 2026, 12:26:14 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-7jrr-xw9c-mj39\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8\n","enisa_id":"EUVD-2026-27133\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 7, 2026, 7:21:17 AM","vulnerabilityProduct":[{"id":"26b50319-57ee-32ad-bdd8-34d3777ab6f7","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.3.8"}],"vulnerabilityVendor":[{"id":"9c900040-ebe4-314c-99d1-9d73694687ba","vendor":{"name":"0xJacky"}}]}},{"id":"c486308e-4920-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-7jrr-xw9c-mj39","description":"Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback","datePublished":"May 5, 2026, 8:49:45 PM","dateUpdated":"Jul 21, 2026, 1:51:31 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-7jrr-xw9c-mj39\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42220\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8\n","enisa_id":"EUVD-2026-27133\n","aliases":"GHSA-7jrr-xw9c-mj39\nCVE-2026-42220\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}