Is CVE-2026-107807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107807 being exploited in the wild.

How severe is CVE-2026-107807?

High severity, with a CVSS score of 8.8, published 9 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728074433-a3999bd78a3b; Nginx UI all versions with query parameter support for node_secret, including dev branch.

How is CVE-2026-107807 attacked?

It is attacked over the network or with local access.

Am I affected by CVE-2026-107807?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107807: Nginx UI node secret credential exposure via URL query parameter

Q: Is there a fix for CVE-2026-107807?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074433-a3999bd78a3b or later. Until then: Configure nginx UI to accept the node secret only via the X-Node-Secret HTTP header and remove support for query parameter authentication. Redesign cluster node configuration to store secrets in separate configuration keys with restricted file permissions rather than embedding them in URLs. Encrypt node tokens at rest in the SQLite database. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107807 attacked?

It is attacked over the network or with local access.

Q: Am I affected by CVE-2026-107807?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107807 · Severity: high · CVSS 8.8 · Published 2026-10-09

Nginx UI is a web-based administration interface for managing nginx reverse proxies and load balancers. The application accepts a master authentication credential (node secret) through URL query parameters, causing it to be logged in plaintext in web server logs, browser history, and configuration files. An attacker with read access to logs or configuration data can extract this credential and gain full unauthenticated administrative control, including the ability to read TLS private keys, modify nginx configurations, and potentially execute code.

Technologies: github.com/0xJacky/Nginx-UI (Go), Nginx UI. Vendors: Go, Nginx UI.

Quick answers

Is CVE-2026-107807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107807 being exploited in the wild.
How severe is CVE-2026-107807?: High severity, with a CVSS score of 8.8, published 9 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728074433-a3999bd78a3b; Nginx UI all versions with query parameter support for node_secret, including dev branch.
Is there a fix for CVE-2026-107807?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074433-a3999bd78a3b or later. Until then: Configure nginx UI to accept the node secret only via the X-Node-Secret HTTP header and remove support for query parameter authentication. Redesign cluster node configuration to store secrets in separate configuration keys with restricted file permissions rather than embedding them in URLs. Encrypt node tokens at rest in the SQLite database. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107807 attacked?: It is attacked over the network or with local access.
Am I affected by CVE-2026-107807?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074433-a3999bd78a3b or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260728074433-a3999bd78a3b
```

Configure nginx UI to accept the node secret only via the X-Node-Secret HTTP header and remove support for query parameter authentication. Redesign cluster node configuration to store secrets in separate configuration keys with restricted file permissions rather than embedding them in URLs. Encrypt node tokens at rest in the SQLite database.

Technical details

Nginx UI's `getNodeSecret()` function accepts the node secret from both the X-Node-Secret HTTP header and the `node_secret` URL query parameter. This query parameter is passed to `AuthRequired()` and `AuthRequiredWS()` middleware on all authenticated API endpoints, bypassing all JWT validation and session checks. The official cluster deployment format stores node secrets directly in configuration files and environment variables as URL query parameters, creating multiple exposure vectors through HTTP access logs, application logs, browser history, WebSocket logs, and database plaintext storage.

Affected products

Nginx UI Nginx UI all versions with query parameter support for node_secret, including dev branch

Identifiers

CVE-2026-107807
GHSA-pvgv-gcp7-v38g
GO-2026-6708

Timeline

2026-10-09: disclosed: Public disclosure via GitHub advisories
2026-04-21: other: Vulnerability identified via source code review

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.