CVE-2026-33028 Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse
Concurrent requests corrupt the configuration file, causing persistent denial of service and potential remote code execution in Nginx UI.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33028?
CVE-2026-33028 is a high-severity vulnerability in 0xJacky nginx-ui, published on 30 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination. This issue has been patched in version 2.3.4.
Weakness: CWE-362
Which versions are affected by CVE-2026-33028?
6 open source packages ship an affected version, including github.com/0xJacky/Nginx-UI and github.com/uozi-tech/cosy. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/0xJacky/Nginx-UI Go | All versions | None |
github.com/0xJacky/Nginx-UI Go | All versions to 1.99 | None |
github.com/0xJacky/Nginx-UI Go | All versions to 1.99 | None |
github.com/uozi-tech/cosy Go | All versions | 1.30.1 |
github.com/uozi-tech/cosy Go | All versions | 1.30.1 |
github.com/uozi-tech/cosy Go | All versions | 1.30.1 |
Products include Nginxui Nginx Ui, Uozi Cosy.
How do I fix CVE-2026-33028?
Upgrade to a fixed version.
Is CVE-2026-33028 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33028 exists.
Other vulnerabilities in 0xJacky nginx-ui
- CVE-2026-33032 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
- CVE-2026-27944 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
- CVE-2024-23827 Nginx-UI arbitrary file write through the Import Certificate feature
- CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
- CVE-2026-33026 nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Sources
Also known as GHSA-m468-xcm6-fxg4, GO-2026-4906.