{"id":"CVE-2026-107804","kind":"vulnerability","aliases":["CVE-2026-107804","GHSA-9h23-53f4-q947","GO-2026-6724"],"related":[],"title":"Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.","summary":"Nginx UI's bundled reverse proxy does not pass the real client address to Gin, so proxied management requests look like they come from loopback and can pass the IP allowlist exception, though valid credentials are still required. An unauthenticated attacker can also make failed logins from many clients share one loopback address, triggering a temporary login ban for everyone without ending existing sessions.","severity":"medium","cvss":5.3,"epss":0.0022,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260904075558-e30e331303fc"],"affected":"< 1.9.10-0.20260904075558-e30e331303fc","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx-ui","package","self-hosted"],"not_affected_if":["no-ip-allowlist","not-using-bundled-proxy"],"how_to_check":null,"fix":"Upgrade to 2.6.0 per the NVD description; the Go advisory lists 1.9.10-0.20260904075558-e30e331303fc as the fixed module version, so confirm which version string applies to your install.","status":"open","published_at":"2026-10-09T15:17:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:03:15+00:00","updated_at":"2026-10-23T20:03:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:03:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 2.6.0 per the NVD description; the Go advisory lists 1.9.10-0.20260904075558-e30e331303fc as the fixed module version, so confirm which version string applies to your install.","summary":"Nginx UI's bundled reverse proxy does not pass the real client address to Gin, so proxied management requests look like they come from loopback and can pass the IP allowlist exception, though valid credentials are still required. An unauthenticated attacker can also make failed logins from many clients share one loopback address, triggering a temporary login ban for everyone without ending existing sessions.","category":"package","who_cares":["nginx-ui","go","self-hosted"],"confidence":0.6,"analyst_note":"Sources conflict on the affected and fixed versions: NVD says 2.2.0 to before 2.6.0 fixed in 2.6.0, while the govuln entry uses 1.9.10-0.20260904075558-e30e331303fc. Confirm the range at https://pkg.go.dev/vuln/GO-2026-6724 and find a version check for the running instance.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ip-allowlist","not-using-bundled-proxy"],"severity_if_unknown":"unknown"},"cost_usd":0.000927,"input_tokens":2298,"output_tokens":1394,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107804':21A,32A '-2026':20A,28A,31A '-6724':29A '/0xjacky/nginx-ui':18A,35A '2.2.0':121C '2.6.0':123C,206C '53f4':25A '9h23':24A 'address':56B,96B,179C 'allow':180C 'allowlist':9A,74B,157C 'also':86B,173C 'although':160C 'attack':84B,183C 'attribut':150C,174C 'authent':195C 'backend':140C 'ban':101B,190C 'bundl':3A,47B,125C 'bypass':7A 'client':55B,92B,133C,171C 'come':66B 'configur':145C 'credenti':78B,162C 'cve':19A,30A 'differ':169C 'enabl':11A 'end':105B 'everyon':103B 'except':75B,159C 'exist':106B,198C 'extern':132C,170C 'fail':88B,166C 'fix':203C 'ghsa':23A 'ghsa-9h23-53f4-q947':22A 'gin':58B,137C 'github.com':17A,34A 'github.com/0xjacky/nginx-ui':16A,33A 'go':27A,36B 'host':43B 'ident':134C 'interfac':114C 'invalid':197C 'ip':8A,73B,156C 'issu':201C 'like':64B 'lockout':14A 'login':13A,89B,100B,167C,189C 'look':63B 'loopback':68B,95B,152C,158C,178C 'make':87B 'manag':61B,146C 'mani':91B 'nginx':1A,38B,44B,108C,117C 'nginx-ui':37B 'one':94B 'otp':194C 'packag':40B 'pass':52B,71B,154C 'password':192C 'preserv':130C 'proxi':5A,49B,60B,127C,144C 'q947':26A 'real':54B 'request':62B,147C 'requir':81B,165C 'revers':4A,48B,126C 'self':42B 'self-host':41B 'server':119C 'session':107B,199C 'share':12A,93B,187C 'still':80B,164C 'temporari':99B,188C 'though':76B 'trigger':97B,185C 'trust':143C 'ui':2A,39B,45B,109C 'unauthent':83B,182C 'use':135C 'user':113C 'valid':77B,161C 'version':205C 'web':112C,118C 'without':104B,196C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T15:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6724","url":"https://pkg.go.dev/vuln/GO-2026-6724","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107804","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107804","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107804","severity":null,"published_at":"2026-10-09T15:17:09+00:00","modified_at":"2026-10-09T16:38:57+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}