Loading story…
Nginx UI disclosed a critical vulnerability, CVE-2026-27944 (CVSS 9.8), that allows unauthenticated attackers to download and immediately decrypt full system backups from exposed management interfaces. The issue affects Nginx UI versions prior to 2.3.2 and is addressed by upgrading to 2.3.3+. The root cause is a combination of missing authentication on the /api/backup endpoint (CWE-306) and improper handling of cryptographic material (CWE-311), enabling direct access to backup archives.
Exploitation is straightforward: an attacker can send a GET request to /api/backup to retrieve an encrypted ZIP backup, while the server simultaneously leaks the Base64-encoded AES-256 key and IV in the X-Backup-Security HTTP response header, allowing immediate decryption. Reported exposed contents include database.db (user credentials), app.ini configuration, SSL certificates and private keys, Nginx configuration and virtual host data, and potentially session tokens, creating follow-on risk for console takeover, man-in-the-middle enablement, and broader network pivoting. A public PoC is available, increasing the likelihood of opportunistic exploitation; the primary mitigation is to upgrade to Nginx UI 2.3.3 or later and ensure the management interface is not publicly reachable.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Belgium's Centre for Cybersecurity issued an advisory warning that the missing-authentication flaw in Nginx UI could lead to full system compromise and urged immediate patching. The notice reflects official government-level dissemination of the risk to defenders.
Follow-on advisories and news coverage stated that affected Nginx UI versions should be upgraded to 2.3.3 or later and warned against exposing the management interface or backup endpoint to the public internet. Additional recommendations included VPN-only access, IP allowlisting, MFA, segmentation, and monitoring for unauthenticated GET requests to /api/backup.
runZero published asset-discovery guidance for CVE-2026-27944, including a query and favicon-based identification method to help defenders find potentially vulnerable Nginx UI instances. The guidance reiterated that versions prior to 2.3.3 were affected and urged organizations to upgrade.
A GitHub pull request to the projectdiscovery nuclei-templates repository added a detection template for identifying exposed Nginx UI /api/backup endpoints that leak backup decryption material in the X-Backup-Security header. The submission included logic to detect encrypted backup ZIP responses and extract the leaked key and IV.
A critical vulnerability, CVE-2026-27944, was disclosed in Nginx UI after researchers found the /api/backup endpoint could be accessed without authentication and exposed the AES-256 key and IV needed to decrypt downloaded backups. The flaw could let remote attackers obtain sensitive data including credentials, session tokens, SSL private keys, and configuration files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcecybersecuritynews.com
Open sourcerunzero.com
Open sourcegithub.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass in **nginx-ui** tracked as `CVE-2026-33032` is being actively exploited to seize control of internet-exposed Nginx servers. The flaw affects nginx-ui deployments with MCP support enabled because the `POST /mcp_message` endpoint enforced only IP whitelisting, while the default empty whitelist behaved as allow-all, leaving the endpoint reachable without authentication. Researchers said attackers can exploit the bug in seconds with minimal HTTP requests, then invoke MCP management functions to modify or delete Nginx configuration files, reload or restart services, redirect or intercept traffic, disrupt applications, and steal administrator credentials and other secrets. Pluto Security reported the issue in March, and multiple security outlets said threat actors began exploiting it in the wild after technical details emerged. The vulnerability carries a **CVSS 9.8** rating and impacts nginx-ui **2.3.5 and earlier**, with fixes released starting in version **2.3.4** and later secure releases also available. Public reporting estimated roughly **2,600 to 2,700** exposed nginx-ui instances online, and Recorded Future and VulnCheck both flagged the bug as under active exploitation. Administrators have been urged to upgrade immediately, disable or restrict MCP access if patching is delayed, populate the IP whitelist with trusted hosts, and review logs for suspicious configuration changes or unauthorized reload activity.
Jun 29, 2026
Researchers disclosed **CVE-2026-27654**, a heap buffer overflow in NGINX's `ngx_http_dav_copy_move_handler()` that affects deployments compiled with `ngx_http_dav_module` and configured with `alias` alongside WebDAV `COPY` or `MOVE` methods. The bug stems from an unsigned underflow in `ngx_http_map_uri_to_path()` when a `Destination` header is shorter than the location prefix, allowing WebDAV root escape and arbitrary file read or write within the worker process's filesystem permissions. Calif.io said it developed multiple proof-of-concept exploits with AI assistance, including variants that could copy sensitive files such as `/etc/passwd` into attacker-accessible locations and write files through `PUT` and `COPY`, while noting that human researchers were needed to turn the initial AI-generated crash into a practical exploit chain. F5 and the NGINX security team were notified in March and released a fix in **NGINX 1.29.7** with advisory `K000160382`, while Calif later published PoC materials on GitHub describing the work as AI-generated and human-verified. Separately, Nebula Security reported a distinct NGINX zero-day dubbed **nginx-poolslip**, describing remote code execution in dynamic variable parsing paths affecting **NGINX 1.31.0** and claiming its autonomous AI agent discovered the flaw; the report said technical details were initially withheld during disclosure and that **NGINX 1.31.1** was later released as the patch. Together, the disclosures underscore a rapid cycle in which AI-assisted research is producing crash reproduction, exploit development, and fresh vulnerability claims against widely deployed NGINX code.
Jun 29, 2026
German government CERT advisories report multiple vulnerabilities in **NGINX** and **NGINX Plus** that can be exploited for **denial of service**, with a newer notice warning that affected **NGINX Open Source** and **NGINX Plus** deployments may also face **potential code execution**. The advisories indicate that the issues affect both the commercial and open source product lines, expanding the risk beyond service disruption alone. The earlier advisory described multiple flaws enabling service outages in NGINX and NGINX Plus, while the later advisory escalated the impact to include possible remote code execution in addition to denial of service. Organizations running internet-facing NGINX infrastructure should review the referenced dCERT notices, identify exposed versions across reverse proxies, load balancers, and web servers, and prioritize vendor-recommended updates or mitigations.
Jun 29, 2026