nginx security_error ai_generated true

nginx stub_status accessible from public internet

ID: nginx/stub-status-exposed

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1 active — — —

Root Cause

Server status page accessible without restriction.

generic

Workarounds

  1. 92% success Restrict access: allow 10.0.0.0/8; deny all; in stub_status location
  2. 88% success Use separate internal port for metrics endpoint

Dead Ends

Common approaches that don't work:

  1. Remove stub_status entirely 72% fail

    No monitoring visibility

  2. Add basic auth only 68% fail

    Credentials can be brute-forced