CVE-2026-27944

Nginx UI (a third-party web administration interface for the Nginx web server) prior to version 2.3.3 exposes its /api/backup endpoint without any authentication (CWE-306) and returns the backup encryption keys in the X-Backup-Security response header (CWE-311). Any unauthenticated attacker who can reach the endpoint over the network can send a single request and receive a full system backup containing user credentials, session tokens, SSL/TLS private keys, and Nginx configurations, then decrypt it immediately using the key leaked in the same response. This effectively hands the attacker the secrets needed to impersonate administrators, decrypt protected data, and potentially take over the underlying Nginx server. All deployments running Nginx UI before 2.3.3 are affected, with the greatest risk on instances where the API is reachable from the internet or from untrusted networks. A public security advisory has been published; the flaw is not yet in CISA KEV, but EPSS assigns a 22.2% probability of exploitation within 30 days (98th percentile), and a separate Nginx UI flaw (CVE-2026-33032) is reported as actively exploited, indicating attackers are targeting this product.

What to do: Upgrade Nginx UI to version 2.3.3 or later immediately. If upgrading is not possible, restrict network access to the /api/backup endpoint (firewall rules, allowlists, or placing the interface behind authentication or on localhost only), and check access logs for unauthenticated requests to /api/backup or downloads using the X-Backup-Security header. If exposure is suspected, rotate all secrets contained in backups, including admin passwords, SSL/TLS private keys, and active session tokens.