CVE-2026-42223

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag is only enforced during writes (via ProtectedFill in SaveSettings) and is completely ignored during reads. This exposes 40+ protected fields including JwtSecret (enabling auth token forgery), NodeSecret (enabling cluster node impersonation), OIDC ClientSecret (enabling OAuth account takeover), and the IP whitelist configuration. This issue has been patched in version 2.3.8.

• CWE-200

• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8Release Notes
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-q4w7-56hr-83rmExploit, Vendor Advisory
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-q4w7-56hr-83rmExploit, Vendor Advisory

Published

May 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42218xrdp is an open source RDP server. Versions 0.10.6 and prior…5.3
• CVE-2026-42219Frappe is a full-stack web application framework. Prior to 1…6.9
• CVE-2026-4222A vulnerability was determined in SSCMS up to 7.4.0. This vu…3.8
• CVE-2026-42220Nginx UI is a web user interface for the Nginx web server. P…6.5
• CVE-2026-42221Nginx UI is a web user interface for the Nginx web server. F…9.8
• CVE-2026-42222Nginx UI is a web user interface for the Nginx web server. I…9.8
• CVE-2026-42224ipl/web is a set of common web components for php projects. …7.6
• CVE-2026-42225PJSIP is a free and open source multimedia communication lib…5.9
• CVE-2026-42226n8n is an open source workflow automation platform. Prior to…7.5
• CVE-2026-42227n8n is an open source workflow automation platform. Prior to…6.5
• CVE-2026-42228n8n is an open source workflow automation platform. Prior to…6.5
• CVE-2026-42229n8n is an open source workflow automation platform. Prior to…8.8