CVE-2026-27944 — Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

CVE-2026-27944

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure PUBLISHED

Description (CNA)

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.

Affected (CNA)

Vendor / product	Versions
0xJacky / nginx-ui	affected < 2.3.3

CWE

CWE-311, CWE-306

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.