CVE-2026-27944: Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

Overview

Nginx UI is a web interface for managing the Nginx web server. CVE-2026-27944 is classified as CWE-306, missing authentication for a critical function. According to the GitHub advisory referenced in the record, a backup function can be reached without authentication and returns decryption keys together with the backup.

Impact

• The description states that the exposed backup may contain user credentials, session tokens, SSL private keys and Nginx configurations.
• Because the decryption material is reported to be returned alongside the backup, the description indicates the data could be decrypted immediately. Real-world impact depends on how each deployment is exposed.
• The record gives a CVSS base score of 9.8 (critical). This reflects the network reachability and lack of required privileges or user interaction recorded in the vector, which is an inference from the score.

Affected products and versions

• 0xJacky Nginx-ui: versions before 2.3.3.
• Nginxui Nginx Ui: versions before 2.3.3.
• The record contains no separate fixed-version field. The description states the issue is patched in 2.3.3.

Exploitation status

• The record shows CISA KEV listing as false. No confirmed active exploitation appears in the sources consulted.
• The GitHub advisory reference is tagged Exploit in the record, and the SSVC exploitation value is poc. These suggest proof-of-concept material may exist, which is not the same as confirmed exploitation.
• The EPSS probability is about 1 percent, with a percentile of 0.62953.

Remediation and mitigation

• Upgrade Nginx UI to version 2.3.3 or later, since the description states this version contains the fix.
• Until the upgrade is applied, restrict access to the management interface to trusted networks and place it behind an authenticating reverse proxy or VPN. This is general hardening guidance, not a vendor-stated mitigation.
• Treat backups created by affected instances as sensitive. If exposure is suspected, consider rotating credentials, session secrets and SSL keys and certificates.
• Review the vendor advisory for any further guidance.

Detection guidance

• Review web server and application logs for unauthenticated requests to backup-related endpoints, especially from unexpected sources.
• Look for unexpected backup downloads or unusually large responses from the management interface.
• Determine whether the management interface was reachable from untrusted networks during the period of possible exposure.

Limitations of the available information

• The record does not provide exploitation timelines, counts of affected deployments or independent technical verification.
• Whether a given installation was exposed depends on network configuration, which the record does not describe.
• The record does not state the exact fixed-version field, so the fix is taken from the description text.

Frequently asked questions

What is CVE-2026-27944?

It is a critical issue in Nginx UI, in versions before 2.3.3, where a backup endpoint can be accessed without authentication and returns the keys needed to decrypt the backup.

Which version fixes the issue?

The description states that the issue is patched in version 2.3.3. Upgrade to that version or later.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does contain signals of public proof-of-concept material.

What data could be exposed?

According to the description, the backup may contain user credentials, session tokens, SSL private keys and Nginx configurations.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.