CVE-2026-42220: Privilege Escalation via Information Disclosure in Nginx UI Vulnerability ID: CVE-2026-42220 CVSS Score: 6.5 Published: 2026-05-05 An information disclosure vulnerability in Nginx UI prior to version 2.3.8 allows authenticated users to extract the internal node secret. This secret can subsequently be abused to bypass authorization checks and escalate privileges to the administrative init user. TL;DR Low-privileged authenticated users can retrieve the system's node.secret via the /api/settings endpoint. This secret can then be passed in the X-Node-Secret header to execute actions as the administrative init user.…