CVE-2026-27944 Nginx UI allows unauthenticated access to backups

A critical vulnerability in Nginx UI, tracked as CVE-2026-27944, allows attackers to download and decrypt full server backups without authentication, according to Security Affairs. The flaw stems from the /api/backup endpoint, which is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header, reads the advisory cited by the article.

As a result, an unauthenticated attacker can obtain a full system backup containing sensitive data such as user credentials, session tokens, SSL private keys, Nginx configurations and more, and decrypt it immediately. The advisory notes that the vulnerability arises from both an unauthenticated backup request and the server exposing the AES-256 encryption key and IV in an HTTP header, enabling immediate decryption of the retrieved archive.

The piece also mentions a Proof of Concept exploit code and emphasises the urgency of securing management interfaces, which should not be exposed to the public internet. The article is by Pierluigi Paganini and dated 8 March 2026.