Executive brief
nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys in github.com/0xJacky/nginx-ui
Affected products
- Go github.com/0xJacky/Nginx-UI
Junglewise Threat Intelligence
CVE-2026-33030: GO-2026-4901 - nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys in github.com/0xJacky/nginx-ui
CVE-2026-33030 · Severity: low · CVSS 3.1 · Published 2026-04-02
Technologies: github.com/0xJacky/Nginx-UI (Go). Vendors: Go.
Related threats
- GO-2026-5521 - Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui
- GO-2026-5565 - Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui
- GO-2026-5412 - Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI
- GO-2026-5210 - Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints in github.com/0xJacky/Nginx-UI
- GO-2026-5227 - Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and rest