nginx-UI hat unverschlüsselte Speicherung von DNS API Tokens und ACME Private Keys in github.com/0xJacky/nginx-ui

The primary impact of CVE-2026-33030 lies in the exposure of sensitive credentials. DNS API tokens, if compromised, grant an attacker the ability to modify DNS records associated with the affected domain. This could be leveraged to redirect traffic to malicious websites (DNS hijacking), intercept email communications, or disrupt service availability. ACME private keys, used for Let's Encrypt certificate management, could allow an attacker to issue fraudulent SSL/TLS certificates, enabling man-in-the-middle attacks and further compromising the integrity of the web application. The blast radius extends beyond the immediate nginx-UI instance, potentially impacting all services relying on the affected DNS infrastructure. The lack of encryption means that any user with access to the server's file system or container storage could easily discover these credentials.

Organizations deploying nginx-UI in production environments, particularly those relying on automated DNS management or Let's Encrypt certificates, are at significant risk. Shared hosting environments where multiple users share the same server resources are especially vulnerable, as a compromise of one user's nginx-UI instance could expose the credentials of others.

• linux / server:

find /var/lib/nginx-ui/ -name '*.conf' -print0 | xargs -0 grep -i 'dns_api_token' # Check for unencrypted tokens
find /var/lib/nginx-ui/ -name '*.key' -print0 | xargs -0 grep -i 'acme_private_key' # Check for unencrypted keys

• generic web:

curl -I http://<nginx-ui-host>/config.json # Check for exposed configuration file

1. 2026-04-02Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-30
3. Geändert2026-03-31
4. EPSS aktualisiert2026-04-07

Given that a fixed version of nginx-UI is not yet available, immediate mitigation strategies are crucial. First, restrict access to the nginx-UI configuration files and storage locations. Implement strict file system permissions, limiting access to authorized users only. Consider using a Web Application Firewall (WAF) or reverse proxy to inspect traffic and potentially block requests attempting to access sensitive configuration data. If possible, rotate existing DNS API tokens and ACME private keys to invalidate any potentially compromised credentials. Monitor system logs for any unusual activity or unauthorized access attempts. Regularly scan the server for vulnerabilities and misconfigurations. Once a patched version of nginx-UI is released, upgrade immediately and verify that the sensitive data is now stored securely, preferably using encryption at rest.