Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.

Public exploit code has been released for this critical Nginx vulnerability. Immediate patching is recommended.

Nginx UI version below 2.3.3 contains a critical sensitive information disclosure vulnerability that allows unauthenticated attackers to access the /api/backup endpoint and retrieve encryption keys from the X-Backup-Security response header. This enables attackers to download and decrypt full system backups, exposing sensitive data such as user credentials, session tokens, SSL private keys, and Nginx configurations.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup
    endpoint is accessible without authentication and discloses the encryption keys required to decrypt the
    backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a
    full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx
    configurations) and decrypt it immediately. This issue has been patched in version 2.3.3. (CVE-2026-27944)

ID	Name	Product	Family	Type	Severity
115158	Nginx UI < 2.3.3 Sensitive Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	critical
438415	SCA: security update for github.com/0xJacky/Nginx-UI (GHSA-g9w5-qffc-6762)	Tenable Cloud Security	SCA Checks	Local	critical
438415	SCA: security update for github.com/0xJacky/Nginx-UI (GHSA-g9w5-qffc-6762)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-27944

critical

Tenable Plugins

critical

critical

critical