CVE-2026-27944 Scanner
CVE-2026-27944 Scanner - Information Disclosure vulnerability in Nginx UI
Used 3.5k times · 4.2k assets checked · url
CVE
CVE-2026-27944
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
nginx-ui
Updated Nov 6, 2026View on NVD →
S4E scanner
CVE history: nginx-ui
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →