{"id":"CVE-2026-107812","kind":"vulnerability","aliases":["CVE-2026-107812","GHSA-662p-52hx-cmh2","GO-2026-6705"],"related":[],"title":"Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.","summary":"Nginx UI's self-upgrade feature downloads a new binary and checks it only against a digest served by the same upgrade mirror, so it accepts any executable that comes with a matching digest. An attacker who controls the mirror or can intercept and alter both responses gets code running inside the Nginx UI process when an operator triggers an upgrade.","severity":"high","cvss":7.5,"epss":0.00175,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260728114330-580585516dd8"],"affected":">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728114330-580585516dd8","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["no operator-triggered self-upgrade","version outside affected range"],"how_to_check":"Compare the installed Nginx UI version against the affected range in GO-2026-6705 (github.com/0xJacky/Nginx-UI).\nSources do not give a command to read the installed version.\nSources do not say whether the upgrade mirror is configurable.","fix":"Upgrade to version 2.5.0 (Go pseudo-version 1.9.10-0.20260728114330-580585516dd8).\nUntil upgraded, avoid running self-upgrade on untrusted networks.","status":"open","published_at":"2026-10-09T16:17:25+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:04+00:00","updated_at":"2026-10-23T19:56:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:56:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to version 2.5.0 (Go pseudo-version 1.9.10-0.20260728114330-580585516dd8).\nUntil upgraded, avoid running self-upgrade on untrusted networks.","summary":"Nginx UI's self-upgrade feature downloads a new binary and checks it only against a digest served by the same upgrade mirror, so it accepts any executable that comes with a matching digest. An attacker who controls the mirror or can intercept and alter both responses gets code running inside the Nginx UI process when an operator triggers an upgrade.","category":"package","who_cares":["nginx-ui","self-hosted","nginx","go"],"confidence":0.7,"analyst_note":"Sources conflict: the description says affected versions are 2.0.0 to 2.5.0, but the Go module range is a pseudo-version span; confirm the exact range at https://pkg.go.dev/vuln/GO-2026-6705 and the GHSA-662p-52hx-cmh2 advisory.","how_to_check":"Compare the installed Nginx UI version against the affected range in GO-2026-6705 (github.com/0xJacky/Nginx-UI).\nSources do not give a command to read the installed version.\nSources do not say whether the upgrade mirror is configurable.","needs_analyst":true,"not_affected_if":["no operator-triggered self-upgrade","version outside affected range"],"severity_if_unknown":"high"},"cost_usd":0.000898,"input_tokens":2315,"output_tokens":1334,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107812':31A,42A '-2026':30A,38A,41A '-6705':39A '/0xjacky/nginx-ui':28A,45A '2.0.0':130C '2.5.0':132C,208C '52hx':35A '662p':34A 'abl':161C 'accept':81B 'alter':100B,163C 'applic':183C 'attack':91B,160C,189C 'attacker-control':188C 'binari':9A,65B,141C 'check':67B 'cmh2':36A 'code':104B,191C 'come':85B 'compromis':21A,156C 'context':197C 'control':93B,190C 'cve':29A,40A 'digest':17A,72B,89B,148C,173C 'download':62B,140C 'execut':83B,170C 'featur':61B 'fix':205C 'get':103B 'ghsa':33A 'ghsa-662p-52hx-cmh2':32A 'github.com':27A,44A 'github.com/0xjacky/nginx-ui':26A,43A 'go':37A,46B 'host':54B 'insid':106B 'instal':184C 'intercept':98B 'interfac':123C 'issu':203C 'malici':169C 'match':88B,172C 'mechan':137C 'mirror':22A,78B,95B,154C,157C 'mitm':24A 'network':159C 'new':64B 'next':200C 'nginx':1A,47B,49B,55B,108B,117C,126C,194C 'nginx-ui':48B 'obtain':149C 'oper':113B,176C 'operator-trigg':175C 'origin':16A,147C 'packag':51B 'process':110B,196C 'rce':18A 'requir':180C 'respons':102B,165C 'run':6A,105B,186C 'same-origin':14A,145C 'self':4A,53B,59B,135C 'self-host':52B 'self-upgrad':3A,58B,134C 'serv':73B 'server':128C 'suppli':167C 'trigger':114B,177C 'ui':2A,50B,56B,109B,118C,195C 'unsign':8A 'upgrad':5A,60B,77B,116B,136C,153C,178C,201C 'user':122C 'valid':138C 'verifi':10A 'version':207C 'via':19A 'web':121C,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T16:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6705","url":"https://pkg.go.dev/vuln/GO-2026-6705","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107812","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107812","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107812","severity":null,"published_at":"2026-10-09T16:17:25+00:00","modified_at":"2026-10-20T14:48:27+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}