Vulnerability · Published Oct 9, 2026 · Assigned by GitHub_M
CVE-2026-107804Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Medium 5.3
In plain English
A medium-severity security flaw in nginx-ui from 0xJacky. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/0xJacky/Nginx-UI | 1.9.10-0.20260904075558-e30e331303fc | GHSA-9h23-53f4-q947 |
| Go | github.com/0xJacky/Nginx-UI | 1.9.10-0.20260904075558-e30e331303fc | GO-2026-6724 |
Affected products (as reported)
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9h23-53f4-q947 x_refsource_CONFIRM
- https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf x_refsource_MISC
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.6.0 x_refsource_MISC