A newly discovered critical flaw in Nginx UI exposes servers to complete data compromise by allowing unauthenticated attackers to download and decrypt full system backups.
The issue, tracked as CVE-2026-27944, has been rated 9.8 (Critical) on the CVSS scale, highlighting its severity and potential impact on production systems worldwide.
Vulnerability Analysis
Security researchers revealed that the flaw originates from two major coding errors in the Go-based Nginx UI application, affecting all versions before 2.3.2.
The first issue lies in the /api/backup endpoint, which fails to enforce proper authentication controls. Unlike the secure restore function that uses middleware to filter unauthorized access, the backup route remains publicly accessible.
This lapse falls under CWE-306 (Missing Authentication for Critical Function), effectively allowing anyone to request a full backup without credentials.
The second problem involves a dangerous cryptographic misimplementation (CWE-311, Missing Encryption of Sensitive Data).
Although Nginx UI attempts to encrypt backup archives using AES-256-CBC, it undermines its own security by returning the decryption keys to the requester.
When a GET request is made to the vulnerable endpoint, the server responds with an X-Backup-Security HTTP header containing a Base64-encoded AES-256 key and a 16-byte Initialization Vector (IV), both in plain text.
This means attackers can not only fetch but also decrypt the backups, immediately gaining access to highly sensitive files such as user credentials, session tokens, database entries, and even SSL private keys.
Security researcher 0xJacky published a working proof-of-concept on GitHub, demonstrating how easily this flaw can be exploited.
The sample Python script sends a simple HTTP request to the target and automatically decrypts the returned archives using the provided key and IV, turning compromise into a single-step process.
Because this attack requires no authentication and can be executed remotely, exposed Nginx UI deployments are at immediate risk.
Threat actors could automate the exploit using common HTTP tools or scanning bots across the internet.
Administrators are urged to take the following measures:
- Patch Management: Upgrade immediately to Nginx UI version 2.3.3, which properly secures the backup endpoint.
- Credential Reset: Rotate all compromised user credentials, API tokens, and sessions.
- Certificate Renewal: Reissue all SSL/TLS keys and certificates stored in affected backups.
- Network Restrictions: Isolate Nginx UI management interfaces from the public internet and allow access only from trusted internal networks.
Failure to update or secure Nginx UI may result in total server compromise, data leaks, and certificate exposure across the environment.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1068,580&ssl=1&description=The issue, tracked as CVE-2026-27944, has been rated 9.8 (Critical) on the CVSS scale, highlighting its severity and potential impact on production systems worldwide.){kind=link}