CVE-2026-33026 CRITICAL

CVE-2026-33026: nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Vendor 0Xjacky

Product nginx-ui

Weakness CWE-312 · Cleartext storage

Published March 30, 2026

Last update March 31, 2026

View on NVD All CVEs

CVSS base score

9.4/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

Key dates

Disclosure timeline

March 30, 2026 CVE published

March 31, 2026 Record updated