CVE-2026-34403: Nginxui Nginx UI

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.

Affected products

• Nginxui Nginx UI: before 2.3.5 (fixed in 2.3.5)

Published 2026-04-20. Last modified 2026-06-17.