CVE-2026-107805: Unauthenticated Storage Exhaustion in Nginx UI Node Authentication

Nginx UI is an open-source web interface designed for managing Nginx web server configurations. Between versions 2.5.0 and 2.5.10, the application includes a node authentication module in internal/nodeauth that processes node-signature HTTP requests. This endpoint allows clustered management nodes to submit operational payloads and synchronize configurations across infrastructure deployments.

The node authentication mechanism includes handlers such as verifyRequest and verifySharedSecretRequest. When incoming HTTP requests reach these endpoints, the system evaluates header metadata and computes body content digests to verify the authenticity and cryptographic integrity of remote nodes before granting access to administrative functionality.

A logic flaw in the request processing pipeline causes the server to execute temporary file staging and body content digest calculation before performing credential verification, replay nonce lookup, or cryptographic signature checks. An unauthenticated attacker capable of sending network traffic to the node authentication API can exhaust disk space, storage I/O, and operating system file descriptors on the host machine.

The root cause of CVE-2026-107805 stems from an inverted processing order in internal/nodeauth/signature.go and internal/nodeauth/body.go. In affected releases, verifyRequest and verifySharedSecretRequest invoked stageRequestBody(request) as the initial step in request processing. This function executed prior to validating credential existence, checking replay nonces, or verifying Ed25519 or SHA-256 signatures.

When stageRequestBody is called, it executes os.CreateTemp("", "nginx-ui-node-request-body-*") to create a temporary file on the host filesystem. The handler then streams the complete HTTP request body into this temporary file while simultaneously writing to an io.MultiWriter to calculate a SHA-256 digest of the incoming payload.

Because no body size limit or pre-authentication check was enforced, an attacker can transmit HTTP POST requests containing arbitrary body payloads. The server commits the incoming payload to temporary disk storage before reaching signature verification logic. Upon signature validation failure, the temporary file is unlinked, but sustained high-concurrency requests consume available disk capacity, disk write throughput, and file handles.

An analysis of internal/nodeauth/signature.go in version 2.5.10 shows that stageRequestBody was called immediately after basic parameter validation, but before signature parsing or credential checks. The original vulnerable flow operated as follows:

// Vulnerable execution sequence in internal/nodeauth/signature.go
contentDigest, err := stageRequestBody(request)
if err != nil {
    return nil, err
}
 
signature, err := parseSignature(request.Header, ed25519.SignatureSize)
if err != nil {
    return nil, err
}

In patch commit 8c9b9a1aff218ee6c980d047b750e49da3c46796, the execution flow was modified to extract header information first and defer disk staging until header parsing, credential database lookups, and replay nonce verifications complete successfully:

// Patched execution sequence in internal/nodeauth/signature.go
receivedDigest, err := requestContentDigest(request)
if err != nil {
    return nil, err
}
 
signature, err := parseSignature(request.Header, ed25519.SignatureSize)
if err != nil {
    return nil, err
}
 
// Replay cache validation occurs prior to body staging
if replayCache == nil || !replayCache.Use(metadata.credentialID+":"+metadata.nonce, now) {
    return nil, errors.New("node request nonce was already used")
}
 
// Body digest staging is executed only after all header checks succeed
if err := verifyRequestBodyDigest(request, receivedDigest); err != nil {
    return nil, err
}

Additionally, internal/nodeauth/body.go was updated to enforce a maximum body size cap using const maxStagedRequestBodySize int64 = 128 << 20 (128 MB). The stageRequestBodyWithLimit function validates request.ContentLength against this threshold and wraps body streaming in io.LimitReader(request.Body, limit) to prevent unbounded resource consumption during payload transfer.

Exploiting this flaw does not require valid authentication credentials, valid cryptographic keypairs, or existing session state. The attacker only requires network access to the Nginx UI node management interface. targeted endpoints process node signature headers and attempt to buffer incoming request bodies regardless of signature validity.

The attack methodology involves sending HTTP requests to node authentication routes with syntactically formed signature headers. The attacker populates the request body with arbitrary data up to the bandwidth limit of the network path. As Nginx UI processes the request, stageRequestBody writes the incoming byte stream to temporary files on the host disk system.

Although temporary files are deleted after request processing terminates, parallel request execution or continuous high-throughput streams overwhelm host resources. Concurrent streams consume available space in /tmp or TMPDIR, causing storage exhaustion, elevated I/O wait times, and operating system file descriptor depletion. This prevents standard application operations and leads to system failure.

CVE-2026-107805 carries a CVSS v3.1 base score of 7.5 (High), defined by vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness is classified under CWE-400 (Uncontrolled Resource Consumption), specifically affecting availability (A:H). Confidentiality and integrity are not directly impacted (C:N, I:N).

Resource exhaustion affects the availability of the Nginx UI application and co-located services that rely on the shared host filesystem or temporary directory partition. Host disk depletion can lead to secondary operational failures, including failed log writes, database transaction halts, and unexpected application terminations.

No public exploit frameworks or automated detection scripts are currently cataloged for this issue. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no active exploitation in ransomware campaigns has been recorded.

The primary remediation for CVE-2026-107805 is upgrading Nginx UI to version v2.6.0 or later. The patched release enforces header validation before disk staging, limits body staging sizes to 128 MB, and avoids temporary file creation for unauthenticated requests.

If immediate software updates cannot be deployed, perimeter controls can reduce exposure. Reverse proxies situated in front of Nginx UI should enforce strict body size constraints using directives such as client_max_body_size on API and node authentication paths.

System-level defenses include mounting the temporary directory (/tmp or TMPDIR) on a separate partition or tmpfs RAM disk configured with strict capacity caps. Network filtering rules should restrict access to node authentication endpoints so that only authorized cluster node IP addresses can establish connections.