Live › vulnerability › CVE-2026-107804
Go to dashboardNginx UI's bundled reverse proxy does not pass the real client address to Gin, so proxied management requests look like they come from loopback and can pass the IP allowlist exception, though valid credentials are still required. An unauthenticated attacker can also make failed logins from many clients share one loopback address, triggering a temporary login ban for everyone without ending existing sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | < 1.9.10-0.20260904075558-e30e331303fc | 1.9.10-0.20260904075558-e30e331303fc |
Unknown from the sources.
Upgrade to 2.6.0 per the NVD description; the Go advisory lists 1.9.10-0.20260904075558-e30e331303fc as the fixed module version, so confirm which version string applies to your install.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107804")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.