CVE-2026-42220: GO-2026-5227 - Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and rest

CVE-2026-42220 · Severity: low · CVSS 3.1 · Published 2026-06-25

Technologies: github.com/0xJacky/Nginx-UI (Go). Vendors: Go.

Executive brief

Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI

Affected products

Go github.com/0xJacky/Nginx-UI

Related threats

GO-2026-5521 - Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui
GO-2026-5565 - Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui
GO-2026-5412 - Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI
GO-2026-5210 - Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints in github.com/0xJacky/Nginx-UI
GO-2026-5129 - Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui