{"items":[{"id":"NVI-00012136","kind":"vulnerability","title":"Nginx UI: Node Secret Credential Exposure via URL Query Parameter","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pvgv-gcp7-v38g","CVE-2026-107807"],"plain_summary":"GitHub lists this reviewed advisory for github.com/0xJacky/Nginx-UI. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b2e1736f90d170b62b3f4754b6066fc6"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-09T17:07:11.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b2e1736f90d170b62b3f4754b6066fc6"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b2e1736f90d170b62b3f4754b6066fc6","url":"https://github.com/advisories/GHSA-pvgv-gcp7-v38g","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pvgv-gcp7-v38g","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:23.763Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b2e1736f90d170b62b3f4754b6066fc6"],"technology":"github.com/0xJacky/Nginx-UI","known_exclusions":[],"conditions_summary":"## 1. Vulnerability Summary\n\nnginx-ui's `Node.Secret` is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a **URL query parameter** (`?node_secret=`), causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs, browser history, and HTTP `Referer` headers. Additionally, the official cluster configuration format embeds node secrets directly into URL query strings stored in `app.ini` and environment variables, creating a systemic credential exposure pattern across the entire cluster deployment model.\n\nAn attacker who gains read access to any log aggregation system, proxy log, or configuration file can extract the node secret and obtain full, persistent, unauthenticated administrative access to the nginx-ui API — including reading TLS private keys, modifying nginx configurations, and (when chained with Bug #1) achieving OS-level code execution.\n\n---\n\n## 2. Root Cause Analysis\n\n### 2.1 Node Secret Accepted as URL Query Parameter\n\nThe `getNodeSecret` function reads the credential from the URL query string as a fallback when the `X-Node-Secret` header is absent: 1 \n\nThis function i","public_affected_ranges":[">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b"]}],"null_published_at":"2026-11-01T01:04:01.245Z","source_updated_at":"2026-10-09T17:07:11.000Z","source_disclosed_at":"2026-10-09T17:07:09.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:23.763Z"}],"next_cursor":null,"snapshot_revision":"42594"}