Critical Nginx UI Flaw Allows Unauthenticated Backup Theft and Decryption

#cybersecurity #infosec

Summary

Nginx UI version 2.3.3 patches a critical vulnerability (CVE-2026-27944) that allows unauthenticated attackers to download and decrypt full server backups. The flaw exposes sensitive data including SSL private keys, admin credentials, and server configurations via an unprotected API endpoint.

Take Action:

If you are using Nginx UI, first make sure they are isolated from the internet. Then patch to version 2.3.3 immediately because the exploit is trivial - especially if your Nginix UI is exposed to the internet.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines