CRITICAL NGINX UI FLAW CVE-2026-27944 EXPOSES SERVER BACKUPS

Summary from the TLDR InfoSec newsletter

CVE-2026-27944 (CVSS 9.8) in Nginx UI exposes the unauthenticated `/api/backup` endpoint, which leaks the AES-256 encryption key and IV via the `X-Backup-Security` response header, enabling full backup decryption without credentials. Successful exploitation yields admin credentials, session tokens, SSL private keys, Nginx configurations, and database secrets, giving attackers complete control over the management interface and mapped infrastructure. A PoC is available. Organizations should restrict management interfaces to private networks or VPNs and apply IP allowlisting and MFA.