An unauthenticated remote attacker capable of reaching the Nginx UI API can initiate requests containing syntactically correct signature metadata but arbitrary, large body payloads. Because the application processes these requests and commits them to temporary storage prior to authentication, a stream of concurrent, malicious requests can consume system-level disk capacity, saturate I/O throughput, and exhaust request-processing threads. This behavior disrupts the availability of Nginx UI and may impact other services residing on the same infrastructure. The vulnerability is strictly an availability concern and does not facilitate unauthorized access, data confidentiality loss, or integrity compromise.

Impact

The vulnerability allows for resource exhaustion, leading to a denial of service. The impact is primarily on system availability, where excessive concurrent requests can lead to full temporary partitions or I/O starvation. The degree of impact depends heavily on environmental factors such as available disk quotas, configured reverse-proxy body limits, and server-side concurrency constraints.

Recommendation

Prioritize upgrading to Nginx UI 2.6.0 or later to mitigate the vulnerability. The patch introduces a check to authenticate request metadata prior to staging and implements improved request body streaming with size constraints and automatic cleanup for discarded requests.

• Upgrade Nginx UI to 2.6.0 or later immediately.
• Review temporary filesystem usage patterns to detect spikes in /tmp or designated staging directories associated with Nginx UI.
• Implement application-level request size limits in front-end reverse proxies (e.g., standard Nginx or HAProxy) to prevent oversized payloads from reaching the application API.
• Configure system-level disk quotas for the service account running Nginx UI to contain the impact of storage exhaustion.

Attack Chain

1. Attacker authenticates to the target Nginx-UI instance and obtains a valid JWT.
2. Attacker initiates an authorized backup request to GET /api/backup to retrieve current encrypted backup artifacts and the required X-Backup-Security token.
3. Attacker decrypts the retrieved backup archive using the extracted security token and IV.
4. Attacker modifies the app.ini file within the decrypted archive to include a malicious payload in the TestConfigCmd setting.
5. Attacker re-encrypts the modified backup archive and regenerates the manifest signature using the same HMAC key derivation logic.
6. Attacker uploads the forged backup via POST /api/restore with the malicious payload included.
7. Attacker invokes POST /api/nginx/test to force the application to execute the modified TestConfigCmd.
8. Arbitrary code executes within the Nginx-UI container context, completing the exploit chain.

Impact

Successful exploitation results in full command execution within the Nginx-UI runtime environment. An attacker can use this access to read or modify sensitive configuration data, extract JWT secrets, corrupt application state, or move laterally within the host environment, depending on the container's privileges and host integration.

Recommendation

Prioritized actions for detection and mitigation:

• Patch Nginx-UI to version 1.9.10-0.20260728074146-a467ed652591 or later to remediate CVE-2026-107806.
• Deploy WAF or web server rules to audit or block POST requests to /api/restore and /api/nginx/test originating from non-administrative user accounts.
• Monitor logs for unusual configuration changes, specifically modifications to app.ini or attempts to trigger nginx test command execution from suspicious user sessions.
• Restrict access to the Nginx-UI interface to trusted internal networks only to minimize the exposure of administrative endpoints.