Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-33030 · CVE overview and exploitation status

EUVD-2026-17156

GHSA-5hf2-vhj6-gj9m

GO-2026-4901

cve-program · CVE-2026-33030

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5hf2-vhj6-gj9m

euvd · EUVD-2026-17156

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5hf2-vhj6-gj9m

nvd · CVE-2026-33030

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5hf2-vhj6-gj9m

osv · GHSA-5hf2-vhj6-gj9m

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5hf2-vhj6-gj9m
• https://nvd.nist.gov/vuln/detail/CVE-2026-33030
• https://github.com/0xJacky/nginx-ui
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4

osv · GO-2026-4901

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5hf2-vhj6-gj9m
• https://nvd.nist.gov/vuln/detail/CVE-2026-33030
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4

• Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources be… · Advisory content revised · 15 Nov 2026