CVE-2026-33026: nginx-ui Backup Restore Vulnerability Allows Malicious Configuration Injection
Summary
CVE-2026-33026: nginx-ui Backup Restore Allows Tampering with Encrypted Backups. Affects github.com/0xJacky/Nginx-UI versions < 1.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx-ui is a web-based user interface for managing Nginx, a popular web server. It provides an intuitive interface for configuring and monitoring Nginx instances, making it easier for users to manage their web server settings. However, a critical vulnerability has been identified in its backup and restore mechanism, which can be exploited to tamper with encrypted backup archives.
Vulnerability Detail
The vulnerability arises from a circular trust model in the nginx-ui backup restore process. The backup files are encrypted, but the encryption key and initialization vector (IV) are exposed to the client. The integrity metadata, which is crucial for verifying the authenticity of the backup, is also encrypted with the same key. This allows an attacker with access to the backup token to decrypt the archive, modify its contents, recompute the integrity hashes, and re-encrypt the files. The restore process does not enforce integrity verification, enabling the restoration of malicious configurations that could lead to arbitrary command execution on the host.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the backup and restore functionality until the package is updated. Additionally, ensure that access to backup tokens is restricted to prevent unauthorized users from exploiting this vulnerability.
Conclusion
The nginx-ui backup restore vulnerability (CVE-2026-33026) poses a significant risk due to its design flaws that allow attackers to tamper with backups. It is crucial for users to update to the latest version to mitigate this risk and ensure the integrity of their configurations.
See every vulnerability recorded for github.com/0xJacky/Nginx-UI →
FAQ
CVE-2026-33026 is a critical vulnerability in the nginx-ui backup restore mechanism that allows attackers to tamper with encrypted backups and inject malicious configurations.
If you are using nginx-ui versions prior to 2.3.4, your installation is vulnerable. You can check your version by running nginx-ui --version.
An attacker could modify application configurations, insert backdoors, execute arbitrary commands, or fully compromise the nginx-ui instance.
The best protection is to update to the patched version of nginx-ui (2.3.4 or later) and restrict access to backup tokens.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the Gopkg.lock file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/0xJacky/Nginx-UI.
