MediumVulnerability
GHSA-q4w7-56hr-83rm: Nginx-UI Settings API Exposes Protected Secrets
- Identifiers
- CVE-2026-42223GHSA-q4w7-56hr-83rm
- Published
- Record updated
- Affected
- github.com/0xJacky/nginx-ui <= 2.3.7
- Fixed in
- 2.3.8
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
The GetSettings handler in api/settings/settings.go serializes every settings struct to JSON for any authenticated user. The protected:"true" tag is enforced only on writes through ProtectedFill in SaveSettings, so more than 40 protected fields, including JwtSecret, NodeSecret, OIDC ClientSecret and the IPWhiteList configuration, are returned on read. Exposed secrets allow forging auth tokens, impersonating cluster nodes and performing OAuth flows as the application.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
- MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
- MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database