github.com/0xJacky/Nginx-UI Known Vulnerabilities & Fixes
github.com/0xJacky/Nginx-UI has 12 known security vulnerabilities in Go Modules. Upgrade to version 2.3.8 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 2.3.8
Upgrading to 2.3.8 or later resolves all 12 known vulnerabilities in github.com/0xJacky/Nginx-UI. Run: go get github.com/0xJacky/Nginx-UI@v2.3.8
Is github.com/0xJacky/Nginx-UI in your project?
Check if you're affected and upgrade to 2.3.8 to stay secure.
Security Summary
- 12 affected version ranges have been identified across these 12 advisories.
- 75% of known issues have a published fixed version.
- Remediation: go get -u github.com/0xJacky/Nginx-UI
Vulnerabilities
12 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Jan 29, 2024, most recently Oct 9, 2026 (984 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2026-42238 Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore | CRITICAL | All versions | 2.3.8 |
| CVE-2026-33032 nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover | CRITICAL | All versions | No fix available |
| CVE-2026-27944 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure | CRITICAL | All versions | 2.3.3 |
| CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite | CRITICAL | All versions | 1.9.10-0.20260728074146-a467ed652591 |
| CVE-2026-33026 nginx-ui Backup Restore Allows Tampering with Encrypted Backups | CRITICAL | All versions | 1.9.10-0.20260315015203-f61bcec547c0 |
| CVE-2024-23827 Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature | CRITICAL | All versions | 1.9.10-0.20240128060047-8581bdd3c6f4 |
| CVE-2026-44015 Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services | HIGH | All versions | No fix available |
| CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs | HIGH | All versions | 1.9.10-0.20260728074433-a3999bd78a3b |
| CVE-2026-107813 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up | HIGH | All versions | 1.9.10-0.20260728074433-a3999bd78a3b |
| CVE-2026-107811 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser | HIGH | All versions | 1.9.10-0.20260728091109-0ecbd106c37b |
| CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter | HIGH | All versions | 1.9.10-0.20260728074433-a3999bd78a3b |
| CVE-2026-33030 nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys | HIGH | All versions | No fix available |
About This Data
Vulnerability data for github.com/0xJacky/Nginx-UI is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related Go Modules Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of github.com/0xJacky/Nginx-UI.