Is CVE-2026-33026 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33026 being exploited in the wild.

How severe is CVE-2026-33026?

Critical severity, with a CVSS score of 4, published 30 March 2026.

Which products and versions are affected?

0xJacky Nginx-UI < 2.3.4; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260315015203-f61bcec547c0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20260315015203-f61bcec547c0.

Is there a fix for CVE-2026-33026?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260315015203-f61bcec547c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33026 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33026?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33026: 0xJacky Nginx-UI configuration tampering via backup restore

Q: Which products and versions are affected?

0xJacky Nginx-UI < 2.3.4; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260315015203-f61bcec547c0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20260315015203-f61bcec547c0.

Q: Is there a fix for CVE-2026-33026?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260315015203-f61bcec547c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33026 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-33026?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33026 · Severity: critical · CVSS 4 · Published 2026-03-30

Nginx-UI, a management interface for the Nginx web server, contains a flaw in how it handles system backups. An attacker can modify a backup file to include malicious settings and then trick the system into restoring it. This could allow an attacker to take complete control of the server, execute unauthorized commands, or disrupt web services.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2026-33026 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33026 being exploited in the wild.
How severe is CVE-2026-33026?: Critical severity, with a CVSS score of 4, published 30 March 2026.
Which products and versions are affected?: 0xJacky Nginx-UI < 2.3.4; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260315015203-f61bcec547c0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20260315015203-f61bcec547c0.
Is there a fix for CVE-2026-33026?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260315015203-f61bcec547c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33026 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33026?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260315015203-f61bcec547c0 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260315015203-f61bcec547c0
```

Technical details

The vulnerability stems from a circular trust model in the backup/restore architecture of nginx-ui. While backups are encrypted using AES-256-CBC, the encryption key and Initialization Vector (IV) are provided to the client, and the integrity metadata (hash_info.txt) is encrypted with that same key. An attacker with access to the backup token can decrypt the archive, modify configuration files (such as app.ini), recompute SHA-256 hashes, and re-encrypt the package. The restore process fails to strictly enforce integrity, allowing tampered backups to be processed even if warnings are triggered, which can lead to Remote Code Execution (RCE) via malicious configuration parameters like 'StartCmd'.

Affected products

0xJacky Nginx-UI < 2.3.4

Identifiers

CVE-2026-33026
GHSA-fhh2-gg7w-gwpq
GO-2026-4903

Timeline

2026-03-28: advisory: GitHub Advisory published
2026-03-30: disclosed: Public disclosure of CVE-2026-33026
2026-03-15: patched: Version 2.3.4 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.