Live › vulnerability › CVE-2026-107813
Go to dashboardNginx UI, a web interface for managing Nginx, leaves its cluster API routes without the OTP step-up check that protects other sensitive actions. An attacker holding a stolen or persisted login token can add, change or delete cluster nodes, read or replace node credentials, and reload or restart Nginx on nodes without a second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod or the running binary; affected range is up to but not including 1.9.10-0.20260728074433-a3999bd78a3b.
1.9.10-0.20260728074433-a3999bd78a3b or later (the description says the fix is in 2.5.0)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107813")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.