{"data":{"id":"20545f5a-2f6a-40fd-9794-1cf5cc5a5e9e","title":"GHSA-q4w7-56hr-83rm: Nginx-UI Settings API Exposes Protected Secrets","summary":"The GetSettings handler in api/settings/settings.go serializes every settings struct to JSON for any authenticated user. The protected:\"true\" tag is enforced only on writes through ProtectedFill in SaveSettings, so more than 40 protected fields, including JwtSecret, NodeSecret, OIDC ClientSecret and the IPWhiteList configuration, are returned on read. Exposed secrets allow forging auth tokens, impersonating cluster nodes and performing OAuth flows as the application.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-q4w7-56hr-83rm","publishedAt":"2026-05-06T17:01:04.000Z","cveId":"CVE-2026-42223","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/0xJacky/nginx-ui@<= 2.3.7 (fixed: 2.3.8)"],"affectedPackageNames":["github.com/0xjacky/nginx-ui"],"affectedPackageRefs":["go:github.com/0xjacky/nginx-ui"],"affectedVendors":[],"affectedVendorsRaw":["Nginx-UI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00295,"epssCheckedAt":"2026-11-08T12:09:01.373Z","kevDateAdded":null,"advisoryAliases":["GHSA-q4w7-56hr-83rm"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-06T17:01:04.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-11-06T00:07:50.519Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.5,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/0xJacky/nginx-ui","fixedVersion":"2.3.8","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-11-06T00:07:50.518Z"}]}}