CVE-2026-33026

Go/github.com/0xJacky/Nginx-UI CVE-2026-33026: critical, EPSS 0.21%

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Action: Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260315015203-f61bcec547c0 or later.

go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260315015203-f61bcec547c0

Affected

Fixed versions

Sources

• osv: GHSA-fhh2-gg7w-gwpq
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq
• https://nvd.nist.gov/vuln/detail/CVE-2026-33026
• https://github.com/0xJacky/nginx-ui/commit/f61bcec547c0f305e35348d6440ef156c1d5c3cb
• https://github.com/0xJacky/nginx-ui
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4
• https://github.com/advisories/GHSA-g9w5-qffc-6762
• https://pkg.go.dev/vuln/GO-2026-4903

CVE-2026-33026 · published 2026-03-30T16:23:34Z · modified 2026-07-06T19:45:08.896363138Z · JSON

Go/github.com/0xJacky/Nginx-UI CVE-2026-33026: unknown, EPSS 0.21%

nginx-ui Backup Restore Allows Tampering with Encrypted Backups in github.com/0xJacky/Nginx-UI

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-4903
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq
• https://github.com/advisories/GHSA-g9w5-qffc-6762

CVE-2026-33026 · published 2026-04-02T18:42:30Z · modified 2026-04-02T21:20:00.506628Z · JSON