Live › vulnerability › CVE-2026-107809
Go to dashboardNginx-UI, a web management interface for Nginx, accepts the browser-stored JWT cookie as an API credential and lacks consistent CSRF or Origin checks on management endpoints. A remote attacker who lures a logged-in administrator to a malicious page can make the victim's browser change Nginx configuration, trigger reloads, or run other management actions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
1.9.10-0.20250517140552-daee3ac7ade1 and < 1.9.10-0.20260728074433-a3999bd78a3b2.0.0 through 2.5.0 are affected, which conflicts with the module pseudo-version range1.9.10-0.20260728074433-a3999bd78a3b or later (description says 2.5.0)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim's session. This issue is fixed in version 2.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107809")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.