CVE-2026-27944

nvd.nist.gov • April 16, 2026

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical NGINX UI Vulnerability CVE-2026-33032 Under Active Exploitation A critical vulnerability in the nginx-ui web server management tool, tracked as CVE-2026-33032, has been actively exploited since March 2026. This flaw allows attackers to bypass authentication on the /mcp_message endpoint, enabling full control over NGINX servers through a single unauthenticated API request. Discovered by Pluto Security, the vulnerability has a CVSS score of 9.8 and affects numerous installations, with over 2,600 instances identified as publicly accessible. The nginx-ui maintainers released a patch (version 2.3.4) on March 15, 2026, but many systems remain unpatched. Attackers can leverage this vulnerability to modify server configurations, reload services, and intercept traffic. Organizations using nginx-ui are urged to update immediately or restrict access to the management interface. The vulnerability highlights risks associated with the integration of AI management protocols in web applications. 16 sources 79

Extracted Entities

CVE-2026-27944

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

Tools (1)