CVE-2026-107807

{
  "etk_id": "ETK-2026-1099",
  "cve_id": "CVE-2026-107807",
  "display_id": "CVE-2026-107807",
  "ghsa_id": "GHSA-pvgv-gcp7-v38g",
  "euvd_id": "EUVD-2026-95882",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Node-secret query exposure in nginx-ui",
  "summary": "nginx-ui deployments that accept the node secret in URL query data can expose that administrative credential through logs, browser metadata, or cluster configuration. An attacker who obtains the credential from one of those sources can access the API with administrative privileges, bypassing ordinary login controls. Read access to affected logging, configuration, environment, or database data is the relevant precondition.",
  "mitigation": "Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074433-a3999bd78a3b. Remove node secrets from URLs and deployment variables, rotate any existing node secrets, and restrict access to historical logs and configuration data.",
  "vendor": "go",
  "product": "go:github.com/0xJacky/Nginx-UI",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.9.10-0.20260728074433-a3999bd78a3b"
      ],
      "package_name": "github.com/0xJacky/Nginx-UI",
      "purl": "pkg:golang/github.com/0xJacky/Nginx-UI"
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0031,
  "epss_percentile": 0.2232,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 29.723193033333335,
  "t0_at": "2026-10-09T15:04:18.109000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-09T21:23:14.011124+00:00",
      "days": 0.2631470153240741,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T15:04:18.109000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-09T17:07:09+00:00",
      "days": 0.08531123842592593,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T15:04:18.109000+00:00",
      "url": "https://github.com/advisories/GHSA-pvgv-gcp7-v38g"
    },
    "trigger_signal": {
      "at": "2026-10-09T15:04:18.109000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T15:04:18.109000+00:00",
      "url": "https://github.com/advisories/GHSA-pvgv-gcp7-v38g"
    }
  }
}