---
id: "CVE-2026-107804"
kind: "vulnerability"
aliases: ["CVE-2026-107804", "GHSA-9h23-53f4-q947", "GO-2026-6724"]
title: "Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI"
severity: "medium"
cvss: 5.3
epss: 0.0022
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/0xJacky/Nginx-UI", "fixed": ["1.9.10-0.20260904075558-e30e331303fc"], "affected": "< 1.9.10-0.20260904075558-e30e331303fc", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "nginx-ui", "package", "self-hosted"]
not_affected_if: ["no-ip-allowlist", "not-using-bundled-proxy"]
published_at: "2026-10-09T15:17:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T20:03:15+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6724", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107804", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107804", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI

Nginx UI's bundled reverse proxy does not pass the real client address to Gin, so proxied management requests look like they come from loopback and can pass the IP allowlist exception, though valid credentials are still required. An unauthenticated attacker can also make failed logins from many clients share one loopback address, triggering a temporary login ban for everyone without ending existing sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/0xJacky/Nginx-UI affected < 1.9.10-0.20260904075558-e30e331303fc fixed 1.9.10-0.20260904075558-e30e331303fc

## Fix

Upgrade to 2.6.0 per the NVD description; the Go advisory lists 1.9.10-0.20260904075558-e30e331303fc as the fixed module version, so confirm which version string applies to your install.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6724
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107804
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107804

## From the sources

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_