CVE-2026-42223 — Nginx UI is a web user interface for the Nginx web server.

title: CVE-2026-42223 - Nginx UI Sensitive Data Exposure via GetSettings API
id: scw-2026-05-04-ai-1
status: experimental
level: high
description: |
  Detects attempts to access the GetSettings API endpoint in Nginx UI, which is vulnerable in versions prior to 2.3.8. This API handler improperly exposes sensitive configuration details like JwtSecret, NodeSecret, and OIDC ClientSecret due to the 'protected:"true"' tag being ignored during read operations. This can lead to authentication token forgery, cluster node impersonation, and OAuth account takeover.
author: SCW Feed Engine (AI-generated)
date: 2026-05-04
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42223/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/settings/settings.go'
      cs-method:
          - 'GET'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse