{"items":[{"id":"NVI-00011931","kind":"vulnerability","title":"0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-32gc-wf3m-78w9","CVE-2026-107811"],"plain_summary":"GitHub lists this reviewed advisory for github.com/0xJacky/Nginx-UI. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-624f124111907ebc5d093ef15ad39b7a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-09T17:07:23.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-624f124111907ebc5d093ef15ad39b7a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-624f124111907ebc5d093ef15ad39b7a","url":"https://github.com/advisories/GHSA-32gc-wf3m-78w9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-32gc-wf3m-78w9","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:23.763Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-624f124111907ebc5d093ef15ad39b7a"],"technology":"github.com/0xJacky/Nginx-UI","known_exclusions":[],"conditions_summary":"Summary\n0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credentials. The source code shows that cluster node list and detail endpoints are reachable by ordinary authenticated users and return node objects containing the token field.\n\nThat same token is also used as the X-Node-Secret shared credential for node-to-node authentication. When the middleware receives a correct node secret, it upgrades the request to initUser and bypasses the normal user-authentication path. As a result, any low-privileged authenticated user can first read a node token from /api/nodes and then impersonate a trusted node against a remote node's management API, achieving cross-node administrative authentication bypass.\n\nDetails\nThe root cause is a combination of sensitive credential exposure and improper trust elevation for node-to-node authentication. First, router/routers.go:87-105 mounts cluster.InitRouter(g) inside the shared /api authenticated route group, so any successfully authenticated user can access node list and detail endpoints.\n\nNext, api/cluster/node.go:19-48 implements GetNode and GetNodeList by directly returning analytic.GetNode(node","public_affected_ranges":[">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b"]}],"null_published_at":"2026-11-01T01:03:56.616Z","source_updated_at":"2026-10-09T17:07:23.000Z","source_disclosed_at":"2026-10-09T17:07:23.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:23.763Z"}],"next_cursor":null,"snapshot_revision":"42594"}