Nginx UI 2.5.0 blocks remote attackers from hijacking configs via unvalidated browser cookies

Nginx UI, a web interface for the Nginx web server, contains a high-severity cross-site request forgery (CSRF) vulnerability identified as CVE-2026-107809. The flaw allows remote attackers to induce logged-in administrators to submit state-changing requests, potentially modifying server configurations or triggering reloads. This issue impacts versions 2.0.0 through 2.4.3 and was addressed in version 2.5.0.

Root cause

The vulnerability arises from a trust-boundary failure between browser-managed cookies and API bearer-token authentication. The frontend stores the JSON Web Token (JWT) in a cookie named `token`. The backend `AuthRequired` middleware accepts this cookie as a valid authentication source if no Authorization header is present. This design allows cross-site requests to carry valid credentials automatically, bypassing the need for explicit token submission.

Attack path

An attacker crafts a malicious site that triggers a POST request to the Nginx UI management endpoint, such as `/api/configs`. Because the target browser automatically includes the `token` cookie with the request, the server authenticates the action. The attacker does not need to read the response. Successful exploitation requires the victim to be logged in without multi-factor authentication like OTP or Passkey, allowing the attacker to rewrite configurations or invoke other management operations.

Affected versions

• Nginx UI versions 2.0.0 through 2.4.3 are vulnerable to CVE-2026-107809.
• The underlying Go package `github.com/0xJacky/Nginx-UI` is affected from commit `daee3ac7ade1` until `a3999bd78a3b`.
• Version 2.5.0 resolves the issue by implementing necessary security controls.

Mitigation

• Upgrade Nginx UI to version 2.5.0 or later to apply the vendor-provided fix.
• Ensure all administrative accounts enforce multi-factor authentication, such as OTP or Passkey, to limit the impact of session hijacking.
• Review server configurations regularly to detect unauthorized changes that may indicate exploitation.

Background: APIs

APIs allow your application to request data from a server on demand. Webhooks allow a server to send data to your application when specific events occur. APIs pull data; webhooks push it. Choose APIs for user-initiated actions and webhooks for asynchronous event notifications.

Read the full guide: APIs vs Webhooks: Choosing the Right Integration Pattern

What to do and how to stay safe: Nginx UI

• Verify the installed version of Nginx UI and upgrade to 2.5.0 if you are running a vulnerable release.
• Enforce multi-factor authentication for all administrative accounts to reduce the risk of CSRF exploitation.
• Monitor server configuration files for unexpected modifications and audit access logs for suspicious activity.
• Ensure that management endpoints enforce strict Origin and Referer validation to mitigate cross-site request forgery risks.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-107809?

The National Vulnerability Database rates CVE-2026-107809 as High with a CVSS score of 8.8.

Which versions of Nginx UI are affected?

Versions 2.0.0 through 2.4.3 are vulnerable. The issue is fixed in version 2.5.0.

Can an attacker read data from the server?

No, the attacker cannot read the cross-origin response, but they can modify configurations and trigger server reloads.