Nginx UI Middleware Gap in CVE-2026-107813 Skips 2FA for Node Management With Valid JWT
A missed middleware wrapper in Nginx UI allows attackers with valid JWTs to restart clusters and manage nodes without second-factor authentication.
Key points
- CVE-2026-107813 affects Nginx UI versions 2.0.0 through 2.5.0.
- The vulnerability stems from an incomplete fix for a previous authentication bypass.
- Attackers can perform cluster-wide reloads using only a stolen JWT token.
Nginx UI contains a high-severity authentication bypass that allows unauthorised access to critical cluster management functions. The flaw exists because a previous security update failed to apply multi-factor authentication checks to the cluster API router.
What happened
Nginx UI is a web interface for the Nginx web server. According to the National Vulnerability Database, versions from 2.0.0 until 2.5.0 are affected by CVE-2026-107813. The issue is rated CVSS 8.8 (High) and is classified under CWE-862 (Brute Force).
The vulnerability is an incomplete remediation of CVE-2026-84315. GitHub advisory GHSA-h246-wpgf-vmq5 explains that the previous fix added a `RequireSecureSession` middleware to several mutation routers, including those for nginx, cert, dns, backup, site, and stream. This middleware enforces an OTP step-up, requiring a fresh second-factor authentication beyond the standard JWT.
However, the fix did not apply to the physically separate `api/cluster` router. This router handles node and namespace mutations, as well as cluster-wide reload and restart operations. Because it lacks the `RequireSecureSession` wrapper, these sensitive actions only require a valid JWT. An authenticated user with a stolen or persisted JWT can therefore perform node CRUD operations, read or replace node credentials, change namespaces, and invoke `nodes/reload_nginx` or `nodes/restart_nginx` without providing a fresh second factor.
Why it matters
This defect allows attackers to escalate privileges within the Nginx UI environment. By bypassing the OTP step-up, an adversary holding a valid session token can manipulate cluster infrastructure. This includes adding, editing, or deleting nodes and triggering service disruptions via forced reloads or restarts. The ability to read and rewrite node token secrets further compromises the integrity of the cluster configuration.
Next steps
- Verify if your Nginx UI version is between 2.0.0 and 2.5.0.
- Check for the presence of the `api/cluster` router in your deployment.
- Monitor logs for unauthorized cluster restart or node modification events.
What to do and how to stay safe: Nginx UI
- Rotate all JWT secrets and node credentials immediately if you suspect compromise.
- Enforce strict IP allow-listing for administrative API endpoints to reduce exposure.
- Monitor cluster logs for unexpected reload or restart commands initiated by known accounts.
- Once the vendor provides an update, apply the patch to version 2.5.0 or later to resolve the missing middleware.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Nginx UI are affected by CVE-2026-107813?
Versions from 2.0.0 up to, but not including, 2.5.0 are affected.
Is there a patch available for this vulnerability?
Yes, the issue is fixed in version 2.5.0.
What can an attacker do with a stolen JWT in this scenario?
They can manage nodes, change namespaces, and restart the Nginx cluster without second-factor authentication.
