Unauthenticated Nginx UI Flaw Leaks Decryption Keys and Server Secrets

**Executive Summary:** A critical vulnerability (CVE-2026-27944, CVSS 9.8) in Nginx UI allowed unauthenticated attackers to download full system backups from an unprotected /api/backup endpoint and decrypt them immediately because the AES-256 key and IV were returned in plaintext via an HTTP header; this exposes administrative credentials, SSL private keys, database secrets, and full configuration, and administrators are advised to update Nginx UI, rotate all potentially compromised secrets, and restrict access to management interfaces.