Read the docs
TI-2026-70055 Aliases CVE-2026-107804GHSA-9h23-53f4-q947

Bundled reverse proxy in Nginx UI bypasses IP allowlists

Priority LOW 29CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

Nginx UI from 2.2.0 before 2.6.0 has a bundled reverse proxy with no trusted proxy configuration, so it does not keep the external client identity (CWE-346). Management requests appear to come from loopback and pass the IP allowlist exception, though valid credentials are still required. An unauthenticated remote attacker can make failed logins from many clients share one loopback address, triggering a shared temporary login ban for password or OTP login.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0022 12th percentileScored 2026-11-07
Fix Fixed nginx-ui (0xJacky): 2.6.0github.com/0xJacky/Nginx-UI (Go): 1.9.10-0.20260904075558-e30e331303fc

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-ui2.2.0 to before 2.6.02.6.0Patch availableCNA
—github.com/0xJacky/Nginx-UI (Go)1.9.10-0.20251005005631-6de168c9454 to before 1.9.10-0.20260904075558-e30e331303fc1.9.10-0.20260904075558-e30e331303fcPatch availableGHSA-9h23-53f4-q947
  • nginx-ui Vendor0xJacky Affected 2.2.0 to before 2.6.0 Fixed in 2.6.0 Patch available CNA
  • github.com/0xJacky/Nginx-UI (Go) Vendor— Affected 1.9.10-0.20251005005631-6de168c9454 to before 1.9.10-0.20260904075558-e30e331303fc Fixed in 1.9.10-0.20260904075558-e30e331303fc Patch available GHSA-9h23-53f4-q947

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*——0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions — — ·0xJacky

Remediation

Upgrade Nginx UI to version 2.6.0. The Go module github.com/0xJacky/Nginx-UI is fixed in version 1.9.10-0.20260904075558-e30e331303fc.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA nginx-ui (0xJacky) Fixed in 2.6.0
  • Fix · GHSA-9h23-53f4-q947 github.com/0xJacky/Nginx-UI (Go) Fixed in 1.9.10-0.20260904075558-e30e331303fc Advisory →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107804
  2. 2026-10-10 Alias added: GHSA-9h23-53f4-q947
  3. 2026-10-10 Fix available: Go/github.com/0xJacky/[email protected] · GHSA-9h23-53f4-q947
  4. 2026-10-10 CVSS score added · GHSA-9h23-53f4-q947
  5. 2026-10-10 Weakness changed · GHSA-9h23-53f4-q947
  6. 2026-10-10 5 new references · GHSA-9h23-53f4-q947

References

Advisory 1

Other 4

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-25472 nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVSS 4.0CRITICAL 9.4
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences