0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

{
  "id": "ad19d43bdc2b08792b8459584ebaaa4f3fb8b960c9271ad9942293fa3c5ffbf0",
  "url": "https://osv.dev/vulnerability/GHSA-32gc-wf3m-78w9",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser",
    "summary": "Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credentials. The source code shows that cluster node list and detail endpoints are reachable by ordinary authenticated users and return node objects containing the token field. That same token is also used as the X-Node-Secret shared credential for node-to-node authentication. When the middleware receives a correct node secret, it upgrades the request to initUser and bypasses the normal user-authentication path. As a result, any low-privileged authenticated user can first read a node token from /api/nodes and then impersonate a trusted node against a remote node's management API, achieving cross-node administrative authentication bypass. Details The root cause is a combination of sensitive credential exposure and improper trust elevation for node-to-node authentication. First, router/routers.go:87-105 mounts cluster.InitRouter(g) inside the shared /api authenticated route group, so any successfully authenticated user can access node list and detail endpoints. Next, api/cluster/node.go:19-48 implements GetNode and GetNodeList by directly returning analytic.GetNode(node). Meanwhile, model/node.go:8-13 defines Token with the JSON tag json:\"token\", meaning the node secret is serialized into API responses. The surrounding code path does not redact that field. Therefore, a low-privileged user can call /api/nodes or /api/nodes/:id and retrieve both the target node URL and",
    "evidence": "osv:GHSA-32gc-wf3m-78w9",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260728091109-0ecbd106c37b",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-32gc-wf3m-78w9",
      "aliases": [
        "CVE-2026-107811",
        "GHSA-32gc-wf3m-78w9",
        "GO-2026-6702"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "1.9.10-0.20250517140552-daee3ac7ade1"
                },
                {
                  "fixed": "1.9.10-0.20260728091109-0ecbd106c37b"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-32gc-wf3m-78w9/GHSA-32gc-wf3m-78w9.json"
          }
        }
      ],
      "modified": "2026-10-19T21:41:11.830882707Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9",
        "https://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512",
        "https://github.com/0xJacky/nginx-ui",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-200",
          "CWE-862"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-09T17:07:23Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-107811",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 376783,
  "published_at": "2026-10-09T17:07:23+00:00"
}

{
  "id": "8dea1394770a17b29e5d8b85faf0dfb47d4c1aa08aa1a1bd8b88c9acad32747b",
  "url": "https://osv.dev/vulnerability/GO-2026-6702",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI",
    "summary": "0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI",
    "evidence": "osv:GO-2026-6702",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260728091109-0ecbd106c37b",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6702",
      "aliases": [
        "CVE-2026-107811",
        "GHSA-32gc-wf3m-78w9",
        "GO-2026-6702"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "1.9.10-0.20250517140552-daee3ac7ade1"
                },
                {
                  "fixed": "1.9.10-0.20260728091109-0ecbd106c37b"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6702.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-19T21:31:35.968158837Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9",
        "https://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6702",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-107811",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 376549,
  "published_at": "2026-10-19T21:08:26+00:00"
}