UpHeron
All vulnerabilities

Servers and applications

GHSA-p355-qjwh-8hgm

OpenAI API Key Exfiltration via Unprotected BaseUrl Setting Change

Severity
Low 2.7
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
2.9.1
Weakness
Insufficiently protected credentials (CWE-522)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Sources
Project advisories (GitHub)

Description

An administrator session or an api:write service token (nginx-ui has no low-privilege interactive users) could change the saved OpenAI base URL or proxy while sending the redacted token placeholder, which restored the stored API key. Subsequent LLM requests then sent the stored key to the new destination. Affects instances with an LLM provider token configured. The changed base URL is visible on the settings page.

The maintainer narrowed the following points: the prerequisite is an administrator-equivalent credential rather than "any authenticated user", and the base URL change is visible in the UI.

Any authenticated user can exfiltrate the stored OpenAI API key by changing the unprotected BaseUrl setting to an attacker-controlled server while preserving the real token via the sentinel value NGINX_UI_REDACTED. The maintainer's own code comment in api/llm/models.go describes this exact attack but protection was only applied to one endpoint.

From 0xJacky/nginx-ui's security advisory. Shortened; the full text is there.

Workarounds

Limit api:write tokens to trusted automation, and rotate the provider key if the saved base URL or proxy changed unexpectedly.

Workarounds as given by 0xJacky/nginx-ui's security advisory.

Affected software

SoftwareAffected versions
Nginx UIServers and applications · github:0xjacky/nginx-ui
  • Every version before 2.9.1

References