All vulnerabilities
CVE-2026-107804GHSA-9h23-53f4-q947GO-2026-6724

github.com/0xJacky/Nginx-UI: Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

0xJacky github.com/0xJacky/Nginx-UIgoWeb servers
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.9.10-0.20260904075558-e30e331303fcFixed versionGitHub
Published9 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1.9.10-0.20260904075558-e30e331303fcgithub.com/0xJacky/Nginx-UI, goGitHubgo get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260904075558-e30e331303fc
  • 1.9.10-0.20260904075558-e30e331303fcgithub.com/0xJacky/Nginx-UI, GoOSVgo get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260904075558-e30e331303fc

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in forwarding headers.

Impact

This has two distinct effects in bundled-proxy deployments:

  • IP allowlist enforcement: management API requests forwarded by the bundled proxy were identified as loopback and could pass the loopback exception even when the external source was not in the configured allowlist. Protected management operations still required valid credentials; this did not grant unauthenticated administrator access.
  • Login availability: failed login attempts from different external sources were attributed to one loopback address. An unauthenticated attacker could therefore trigger the shared temporary login-ban threshold and deny password or OTP login to other users behind the proxy until the ban expired. Existing authenticated sessions were not invalidated.

Remediation

Upgrade to Nginx UI 2.6.0 or later. The fix explicitly trusts only the intended bundled proxy, validates configured trusted proxies, uses the resolved client address consistently, and fails closed when an IP allowlist is enabled but the client address is invalid.

Fix commit: https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf

Text from GitHub Advisory Database

Affected versions 3

  • github.com/0xJacky/Nginx-UI, go>= 1.9.10-0.20251005005631-6de168c9454, < 1.9.10-0.20260904075558-e30e331303fcGitHub
  • nginx-uiaffected: >= 2.2.0, < 2.6.0CVE List
  • github.com/0xJacky/Nginx-UI, Gofrom 1.9.10-0.20251005005631-6de168c9454, fixed in 1.9.10-0.20260904075558-e30e331303fcOSV

References 5