{"id":"EUVD-2026-95882","enisaUuid":"79b98155-2fee-3bbc-9f25-9be51cf267a8","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:04:18 PM","dateUpdated":"Oct 9, 2026, 5:57:31 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g\nhttps://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","aliases":"CVE-2026-107807\nGHSA-pvgv-gcp7-v38g\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"080e0470-c53d-3f66-8974-90de1ea81db3","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.5.0"}],"enisaIdVendor":[{"id":"166cf466-36bc-3a6d-99cd-a2dfc2aca262","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"330aff66-0bf3-3905-953a-3dfacbdf6c7b","vulnerability":{"id":"GHSA-pvgv-gcp7-v38g","description":"Nginx UI: Node Secret Credential Exposure via URL Query Parameter","datePublished":"Oct 9, 2026, 5:07:09 PM","dateUpdated":"Oct 9, 2026, 5:07:09 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g\nhttps://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95882\n","aliases":"CVE-2026-107807\nGHSA-pvgv-gcp7-v38g\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a1aa5193-f8ef-319a-b6d2-393665389841","vulnerability":{"id":"CVE-2026-107807","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:04:18 PM","dateUpdated":"Oct 9, 2026, 5:57:31 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g\nhttps://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95882\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Oct 29, 2026, 7:16:20 AM","vulnerabilityProduct":[{"id":"6628f0dd-5746-3b07-8d7f-8f55788847bb","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.5.0"}],"vulnerabilityVendor":[{"id":"605fefdf-7d34-3c8c-b92e-895be588539d","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}