Nginx UI Information Disclosure (CVE-2026-27944)
Severity:
Critical
Summary
Nginx UI before version 2.3.3 contains an information disclosure vulnerability in the unauthenticated /api/backup endpoint, which exposes encryption keys via the X-Backup-Security response header. An unauthenticated attacker can use the exposed key to download and decrypt full system backups, gaining access to sensitive data including credentials and private keys.
Impact
Unauthenticated attackers can access and decrypt system backups, revealing sensitive configuration information, authentication credentials, and cryptographic keys.
Remediation
Upgrade to the latest Nginx UI version
Required Skills for Successful Exploitation
Actions To Take
Classifications
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Select Vulnerability
Related Vulnerabilities
Featured resources
Build your resistance to threats. And save hundreds of hours each month.
