Nginx UI: Node Secret Credential Exposure via URL Query Parameter

{
  "id": "6a7a4906baea0f602b78d1661bcdd653a436cf9fdf495e4096435940414dde1f",
  "url": "https://osv.dev/vulnerability/GHSA-pvgv-gcp7-v38g",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: Node Secret Credential Exposure via URL Query Parameter",
    "summary": "## 1. Vulnerability Summary nginx-ui's `Node.Secret` is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a **URL query parameter** (`?node_secret=`), causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs, browser history, and HTTP `Referer` headers. Additionally, the official cluster configuration format embeds node secrets directly into URL query strings stored in `app.ini` and environment variables, creating a systemic credential exposure pattern across the entire cluster deployment model. An attacker who gains read access to any log aggregation system, proxy log, or configuration file can extract the node secret and obtain full, persistent, unauthenticated administrative access to the nginx-ui API — including reading TLS private keys, modifying nginx configurations, and (when chained with Bug #1) achieving OS-level code execution. --- ## 2. Root Cause Analysis ### 2.1 Node Secret Accepted as URL Query Parameter The `getNodeSecret` function reads the credential from the URL query string as a fallback when the `X-Node-Secret` header is absent: [1](#3-0) This function is called in both `AuthRequired()` and `AuthRequiredWS()` middleware, meaning the query parameter bypass works for **all authenticated HTTP and WebSocket endpoints**: [2](#3-1) [3](#3-2) The same pattern is repeated in the WebSocket origin checker, which also reads `node_secret` from the URL: [4](#3-3) ### 2",
    "evidence": "osv:GHSA-pvgv-gcp7-v38g",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260728074433-a3999bd78a3b",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-pvgv-gcp7-v38g",
      "aliases": [
        "CVE-2026-107807",
        "GHSA-pvgv-gcp7-v38g",
        "GO-2026-6708"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "1.9.10-0.20250517140552-daee3ac7ade1"
                },
                {
                  "fixed": "1.9.10-0.20260728074433-a3999bd78a3b"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pvgv-gcp7-v38g/GHSA-pvgv-gcp7-v38g.json"
          }
        }
      ],
      "modified": "2026-10-19T21:41:21.908207364Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g",
        "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954",
        "https://github.com/0xJacky/nginx-ui",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-312",
          "CWE-598"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-09T17:07:09Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-107807",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 376805,
  "published_at": "2026-10-09T17:07:09+00:00"
}

{
  "id": "84a62bdb08032263ef2e13fc7c7ba15fd7a07870dba64ae2635e5e037d031c77",
  "url": "https://osv.dev/vulnerability/GO-2026-6708",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: Node Secret Credential Exposure via URL Query Parameter in github.com/0xJacky/Nginx-UI",
    "summary": "Nginx UI: Node Secret Credential Exposure via URL Query Parameter in github.com/0xJacky/Nginx-UI",
    "evidence": "osv:GO-2026-6708",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260728074433-a3999bd78a3b",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6708",
      "aliases": [
        "CVE-2026-107807",
        "GHSA-pvgv-gcp7-v38g",
        "GO-2026-6708"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "1.9.10-0.20250517140552-daee3ac7ade1"
                },
                {
                  "fixed": "1.9.10-0.20260728074433-a3999bd78a3b"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6708.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-19T21:31:49.018903603Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g",
        "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6708",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-107807",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 376682,
  "published_at": "2026-10-19T21:08:26+00:00"
}