CVE-2026-107809: Nginx UI CSRF Flaw in v2.0-2.4.3 Lets Attackers Hijack Admin Sessions to Alter Configs

A high-severity cross-site request forgery (CSRF) vulnerability in Nginx UI allows remote attackers to execute unauthorized configuration changes on Nginx web servers. The flaw, tracked as CVE-2026-107809 with a CVSS score of 8.8, impacts installations running versions 2.0.0 through 2.4.3. According to the National Vulnerability Database and GitHub advisory GHSA-33rr-wq23-g6gg, the issue arises from how the application handles authentication tokens within the browser environment.

The risk

The vulnerability exists because Nginx UI stores JSON Web Tokens (JWTs) in browser-managed cookies named `token`. The application’s `AuthRequired` middleware accepts this cookie as a valid API credential. However, management endpoints protected by this middleware do not universally enforce CSRF tokens or validate Origin and Referer headers. Consequently, an attacker can craft a malicious website that induces a logged-in administrator’s browser to submit state-changing requests to the Nginx UI management interface.

Because the browser automatically attaches the `token` cookie to cross-site requests, the attacker does not need to steal the token or read the cross-origin response. The attacker can modify Nginx configurations, trigger service reloads, or invoke other management operations accessible to the victim’s session. This capability is particularly dangerous for accounts that do not require one-time passwords (OTP) or passkeys, as the `RequireSecureSession` mechanism does not provide a universal second factor for all state-changing operations. The core issue is a trust-boundary failure where browser-initiated cross-site requests carry valid API credentials automatically.

Who is exposed

The vulnerability affects users of Nginx UI, a web-based management interface for the Nginx web server developed by 0xJacky. Specifically, versions 2.0.0 through 2.4.3 are vulnerable. According to the GitHub advisory, the underlying Go package `github.com/0xJacky/Nginx-UI` is affected from commit `daee3ac7ade1` up to `a3999bd78a3b`. Any organization using these versions to manage Nginx configurations is exposed to potential unauthorized configuration changes if an administrator visits a malicious site while authenticated.

Cost and compliance

The source material does not provide specific data on financial costs or regulatory compliance implications for this vulnerability. However, unauthorized configuration changes could lead to service disruptions or security misconfigurations, which may impact compliance with frameworks requiring strict access controls and configuration management.

What should you do?

Security teams should immediately audit their Nginx UI installations to determine if they are running a vulnerable version. If the software is in use, prioritize upgrading to version 2.5.0, which contains the fix for CVE-2026-107809. Additionally, review administrator accounts to ensure that strong authentication methods, such as OTP or passkeys, are enforced to mitigate the risk of session-based attacks.

Background: Passkeys

Implement passkeys by using platform authenticators for convenience and roaming authenticators for cross-device access. Sync keys through secure cloud services, enforce biometric or PIN unlocking, and monitor for unauthorized device registrations. This approach removes password storage risks while maintaining strong user authentication.

Read the full guide: Passkeys Best Practices: Secure Authentication Without Passwords

What to do and how to stay safe: Nginx UI

• Verify the current version of Nginx UI in your environment and compare it against the affected range (2.0.0 to 2.4.3).
• Upgrade to version 2.5.0 or later once the vendor provides the update to patch the CSRF vulnerability.
• Enforce multi-factor authentication, such as OTP or passkeys, for all administrator accounts to add a layer of protection against session hijacking.
• Monitor server logs for unexpected configuration changes or reload commands originating from known administrator sessions.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107809?

CVE-2026-107809 is a high-severity CSRF vulnerability in Nginx UI that allows remote attackers to modify server configurations via authenticated admin sessions.

Which versions of Nginx UI are affected?

Versions 2.0.0 through 2.4.3 are affected by this vulnerability.

Is there a fix available?

Yes, the issue is fixed in version 2.5.0.