CVE-2026-33028

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination. This issue has been patched in version 2.3.4.

• CWE-362

• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4Product, Release Notes
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m468-xcm6-fxg4Exploit, Mitigation, Vendor Advisory

Published

Mar 30, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33022Tekton Pipelines project provides k8s-style resources for de…6.5
• CVE-2026-33023libsixel is a SIXEL encoder/decoder implementation derived f…7.8
• CVE-2026-33024AVideo is a video-sharing Platform. Versions prior to 8.0 co…9.1
• CVE-2026-33025AVideo is a video-sharing Platform. Versions prior to 8.0 co…8.8
• CVE-2026-33026Nginx UI is a web user interface for the Nginx web server. P…9.1
• CVE-2026-33027Nginx UI is a web user interface for the Nginx web server. P…6.5
• CVE-2026-33029Nginx UI is a web user interface for the Nginx web server. P…6.5
• CVE-2026-33030Nginx UI is a web user interface for the Nginx web server. I…9.9
• CVE-2026-33031Nginx UI is a web user interface for the Nginx web server. P…8.1
• CVE-2026-33032Nginx UI is a web user interface for the Nginx web server. I…9.8
• CVE-2026-33033An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.…6.5
• CVE-2026-33034An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.…7.5