# Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Nginx UI's api/cluster router was missed by the CVE-2026-84315 secure-session fix, letting a JWT-only attacker do node CRUD and cluster-wide nginx reload/restart without OTP step-up.

- Payout: Research
- Severity: high
- Program: Nginx UI
- Found by: arpitjain099
- Disclosed: 2026-10-09
- CVE: CVE-2026-107813
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-h246-wpgf-vmq5
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-h246-wpgf-vmq5
- Tags: area:web domain:api domain:web impact:dos impact:privesc kind:research platform:ghsa sev:high tech:go technique:source-review vuln:access-control vuln:auth-bypass vuln:mfa-bypass

**Target:** Go HTTP API router (api/cluster) behind JWT auth middleware
**Root cause:** The prior fix wrapped nginx/cert/dns/backup/site/stream mutation routers in middleware.RequireSecureSession() but left the physically separate api/cluster router registering node CRUD, namespace CRUD, and cluster reload/restart directly on the AuthRequired+Proxy-only group.
**Steps:**
1. Obtain a valid JWT for an OTP-enabled user but do not perform step-up (no fresh X-Secure-Session-ID).
2. Call `POST /api/nginx/reload` — returns the secure-session challenge, confirming step-up is enforced on the nginx router.
3. Call `POST /api/nodes` (AddNode) or `POST /api/nodes/reload_nginx` with the same JWT — succeeds without step-up.
4. Optionally `POST /api/nodes/:id` (EditNode) to read back and rewrite the AES-serialized node token secret, or DELETE to remove nodes.
**How found:** Reviewed the parent advisory GHSA-5v7c-xpfp-p65m fix, noticed it only touched the nginx/cert/dns/backup/site/stream routers, then checked the parallel api/cluster router and saw it mounts on the same AuthRequired+Proxy group without a RequireSecureSession subgroup.
**Exploitation:** An attacker holding a stolen or persisted JWT (no fresh secure session) hits the cluster endpoints directly: adds/edits/deletes cluster nodes to read and rewrite the cross-node token secret, and triggers nodes/reload_nginx and nodes/restart_nginx cluster-wide, plus namespace CRUD/reorder. No live instance was stood up; verified by source review.
**Escalation:** Node token secret read/rewrite yields control over remote cluster nodes; cluster-wide reload/restart gives DoS and config-activation leverage beyond a single node.
**Insight:** When a step-up/OTP fix lands, enumerate every router package that mounts on the same base group — sibling routers in separate packages (here api/cluster vs api/nginx) are easy to miss and inherit only the base auth middleware.