Critical Nginx UI flaw exposes full system backups to unauthenticated attackers

A critical vulnerability in Nginx UI could allow attackers to download and decrypt full server backups without authentication. The flaw, tracked as CVE-2026-27944, carries a CVSS score of 9.8 and affects all Nginx UI versions prior to 2.3.2, according to the project’s security advisory.

Security researchers say the issue stems from improper access controls and a serious cryptographic design mistake. An exposed API endpoint allows attackers to download encrypted backup archives, while the application simultaneously sends the encryption key needed to unlock those backups in the HTTP response header.

As a result, attackers can retrieve sensitive server data, including configuration files, credentials, SSL certificates, and private keys, which could enable further compromise of web infrastructure.

How the vulnerability works

The problem involves the /api/backup endpoint in the Nginx UI management interface. This endpoint does not enforce authentication checks in affected versions.

When a request is sent to this endpoint, the server returns backup files packaged in encrypted ZIP archives.

However, the server also exposes the encryption details used to secure those backups.

Specifically, the application sends the following information inside an HTTP header called X-Backup-Security:

• Base64-encoded AES-256 encryption key
• Initialization Vector (IV)

This effectively gives attackers everything needed to decrypt the backup.

Attackers only need to:

1. Send a simple HTTP GET request to the backup endpoint
2. Download the encrypted archive
3. Extract the encryption key and IV from the response header
4. Decrypt the archive locally

Because no login is required, the attack can be carried out remotely.

Key vulnerability details

Item	Details
CVE ID	CVE-2026-27944
Severity	Critical
CVSS score	9.8
Weakness type	CWE-306 (Missing Authentication) and CWE-311 (Sensitive Data Exposure)
Affected software	Nginx UI versions before 2.3.2
Fixed version	2.3.3

The flaw combines two separate issues that together create a severe exposure:

• Missing authentication on the backup API endpoint
• Exposure of encryption keys used to protect backup data

What attackers can access

If attackers successfully exploit the vulnerability, they can obtain the complete server backup and decrypt it immediately.

Sensitive files that may be exposed include:

• database.db containing application user credentials
• app.ini configuration files
• Nginx configuration and virtual host setups
• TLS/SSL certificates and private keys
• Session tokens and authentication data

This information could allow attackers to take control of the Nginx UI console or impersonate legitimate servers.

In some cases, the exposed keys may also enable man-in-the-middle attacks against encrypted traffic handled by the affected server.

Proof-of-concept exploit already available

Security researchers say a public proof-of-concept (PoC) exploit script has already been released.

The PoC demonstrates how attackers can automate the process using Python to:

• Request the backup archive
• Extract encryption keys from the response header
• Decrypt the backup locally

This increases the urgency for administrators to patch affected systems.

Mitigation steps

Administrators should take immediate action to secure Nginx UI deployments.

Immediate fixes

• Upgrade to Nginx UI version 2.3.3 or later
• Verify that the /api/backup endpoint requires authentication

Temporary protections

If patching cannot be performed immediately, organizations should:

• Block public access to the /api/backup endpoint
• Restrict management interfaces to internal networks or VPN access only
• Implement firewall rules limiting access to trusted IP addresses

Detection recommendations

Security teams should also check whether the vulnerability has already been exploited.

Indicators to monitor include:

• Unexpected GET requests to /api/backup
• HTTP responses containing the X-Backup-Security header
• Large backup archive downloads from unknown IP addresses
• Access attempts to the management interface from external networks

Reviewing web server logs can help identify suspicious activity related to the endpoint.

Security checklist for administrators

• Update Nginx UI immediately
• Restrict management access to trusted networks
• Monitor server logs for suspicious backup downloads
• Rotate credentials stored in the system database
• Replace exposed TLS certificates and private keys

These actions help prevent attackers from using stolen configuration data to launch further attacks.

FAQ