Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 nginx-ui, Cross-Site WebSocket Hijacking (CSWSH), #CVE-2026-34403 (Critical) https://dailycve.com/nginx-ui-cross-site-websocket-hijacking-cswsh-cve-2026-34403-critical/
Post summary
The post announces the critical CVE‑2026‑34403 affecting nginx‑ui, describing it as a Cross‑Site WebSocket Hijacking vulnerability, but provides no details on PoC, exploitation, patches, or active attacks.
CVE-2026-34403 Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrig… https://www.cve.org/CVERecord?id=CVE-2026-34403
Post summary
The post references CVE-2026-34403, noting that pre‑2.3.5 Nginx UI WebSocket endpoints use a gorilla/websocket Upgrader with improper CheckOrigin handling, but it provides no PoC, exploit, patch, or active‑exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nginxui | nginx_ui | - | - | - |