CVE-2026-27944

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

State: Published
Severity: 9.8 Critical
Published: Mar 5, 2026
Updated: Mar 19, 2026
Reserved: Feb 25, 2026

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-311 Missing Encryption of Sensitive Data
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
nginx-ui0xJacky	< 2.3.3Affected

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.