CVE-2026-27944

This PoC exploits an authentication bypass vulnerability in Nginx UI (CVE-2026-27944) by decrypting backup files retrieved from an unauthenticated API endpoint. It leverages AES-256-CBC decryption using keys extracted from the 'X-Backup-Security' header to expose sensitive configuration data.

This repository contains a functional Python exploit for CVE-2026-27944, which allows unauthenticated attackers to download and decrypt Nginx UI server backups via the /api/backup endpoint. The exploit includes both scanning and exploitation capabilities, with detailed technical documentation.

This repository contains a functional Python exploit for CVE-2026-27944, which allows unauthenticated attackers to download and decrypt Nginx UI server backups via the /api/backup endpoint. The exploit includes both scanning and exploitation capabilities, with detailed technical documentation.

This repository provides a functional exploit for CVE-2026-27944, an unauthenticated backup download and decryption vulnerability in Nginx UI. The exploit downloads encrypted backups via the /api/backup endpoint, extracts the AES-256-CBC key/IV from the X-Backup-Security header, and decrypts the backup to extract sensitive credentials and configurations.

The PoC exploits CVE-2026-27944 by fetching an nginx-ui backup from a public endpoint and decrypting it using a private key leaked in the response headers. The script decrypts all files in the backup using AES-CBC.

Technical writeup detailing the exploitation chain for CVE-2026-27944 (unauthenticated backup disclosure in Nginx UI leading to AES key exposure and credential compromise) and CVE-2026-3888 (TOCTOU race condition in snapd for LPE). Includes root cause analysis, exploit steps, and patch insights.

This repository contains a functional exploit for CVE-2026-27944, targeting Nginx UI. The exploit automates the unauthenticated download of encrypted backups, decrypts them using leaked AES keys from HTTP headers, extracts sensitive secrets (JWT Secret, Node Secret), and creates a rogue admin account for full dashboard access.

This is a detailed technical writeup for exploiting CVE-2026-27944 (Nginx UI unauthenticated backup disclosure) and CVE-2026-3888 (snapd race condition LPE) to achieve full system compromise on a Hack The Box machine. It includes step-by-step exploitation details, code snippets, and references.

This repository contains a functional exploit for CVE-2026-27944, targeting Nginx UI. The exploit automates the download of encrypted backups, decrypts them using leaked AES keys, extracts sensitive secrets, and creates an admin user for dashboard access.

This repository contains a multi-threaded scanner for detecting Nginx UI instances and identifying those vulnerable to CVE-2026-27944 (versions ≤ 2.3.2). It uses passive fingerprinting and API endpoint probing to determine version and vulnerability status.

This repository contains a fully functional lab environment and exploit for CVE-2026-27944, demonstrating unauthenticated backup download and encryption key disclosure in Nginx-UI versions < 2.3.2. The exploit includes a PoC script that downloads encrypted backups and decrypts them using keys disclosed in response headers.