# CVE-2026-33026: 0xJacky Nginx-UI configuration tampering via backup restore

Source: https://junglewise.ai/threats/cve-2026-33026-0xjacky-nginx-ui-configuration-tampering-via-backup-restore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-30. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-33026 · Severity: critical · CVSS 4 · Published 2026-03-30

Nginx-UI, a management interface for the Nginx web server, contains a flaw in how it handles system backups. An attacker can modify a backup file to include malicious settings and then trick the system into restoring it. This could allow an attacker to take complete control of the server, execute unauthorized commands, or disrupt web services.

Technologies: [0xJacky Nginx-UI](https://junglewise.ai/threats/technologies/nginx-ui), [github.com/0xJacky/Nginx-UI (Go)](https://junglewise.ai/threats/technologies/github-com-0xjacky-nginx-ui). Vendors: [0xJacky](https://junglewise.ai/threats/vendors/0xjacky), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-33026 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33026 being exploited in the wild.

**How severe is CVE-2026-33026?** Critical severity, with a CVSS score of 4, published 30 March 2026.

**Which products and versions are affected?** 0xJacky Nginx-UI < 2.3.4; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260315015203-f61bcec547c0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.10-0.20260315015203-f61bcec547c0.

**Is there a fix for CVE-2026-33026?** Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260315015203-f61bcec547c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33026 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33026?** Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260315015203-f61bcec547c0 or later

  ```sh
  go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260315015203-f61bcec547c0
  ```


## Technical details

The vulnerability stems from a circular trust model in the backup/restore architecture of nginx-ui. While backups are encrypted using AES-256-CBC, the encryption key and Initialization Vector (IV) are provided to the client, and the integrity metadata (hash_info.txt) is encrypted with that same key. An attacker with access to the backup token can decrypt the archive, modify configuration files (such as app.ini), recompute SHA-256 hashes, and re-encrypt the package. The restore process fails to strictly enforce integrity, allowing tampered backups to be processed even if warnings are triggered, which can lead to Remote Code Execution (RCE) via malicious configuration parameters like 'StartCmd'.

## Affected products

- 0xJacky Nginx-UI < 2.3.4

## Identifiers

- CVE-2026-33026
- GHSA-fhh2-gg7w-gwpq
- GO-2026-4903

## Timeline

- 2026-03-28: advisory: GitHub Advisory published
- 2026-03-30: disclosed: Public disclosure of CVE-2026-33026
- 2026-03-15: patched: Version 2.3.4 released to address the issue

## References

- [https://api.github.com/users/dapickle](https://api.github.com/users/dapickle)
- [https://github.com/dapickle](https://github.com/dapickle)
- [https://api.github.com/users/dapickle/gists%7B/gist_id%7D](https://api.github.com/users/dapickle/gists%7B/gist_id%7D)
- [https://api.github.com/users/dapickle/repos](https://api.github.com/users/dapickle/repos)
- [https://avatars.githubusercontent.com/u/196770874?v=4](https://avatars.githubusercontent.com/u/196770874?v=4)
- [https://api.github.com/users/dapickle/events%7B/privacy%7D](https://api.github.com/users/dapickle/events%7B/privacy%7D)

## Related threats

- [Nginx UI Casdoor SSO login CSRF via constant state parameter](https://junglewise.ai/threats/cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter)
- [Nginx UI OTP secure-session step-up bypass via MCP](https://junglewise.ai/threats/cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp)
- [Nginx UI short token cache bypass after account re-enable](https://junglewise.ai/threats/cve-2026-84321-nginx-ui-standalone-short-tokens-survive-administrative)
- [Nginx UI auto backup path traversal in storage boundary](https://junglewise.ai/threats/cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated)
- [Nginx UI MCP configuration directive validation bypass](https://junglewise.ai/threats/cve-2026-84319-nginx-ui-mcp-configuration-tools-bypass-restricted-directive)