{"id":"CVE-2026-107813","kind":"vulnerability","aliases":["CVE-2026-107813","GHSA-h246-wpgf-vmq5","GO-2026-6706"],"related":[],"title":"Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.","summary":"Nginx UI, a web interface for managing Nginx, leaves its cluster API routes without the OTP step-up check that protects other sensitive actions. An attacker holding a stolen or persisted login token can add, change or delete cluster nodes, read or replace node credentials, and reload or restart Nginx on nodes without a second factor.","severity":"high","cvss":8.8,"epss":0.00305,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260728074433-a3999bd78a3b"],"affected":">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["no-otp-enabled-users","versions-at-or-after-fix","versions-before-2.0.0"],"how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod or the running binary; affected range is up to but not including 1.9.10-0.20260728074433-a3999bd78a3b.","fix":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074433-a3999bd78a3b or later (the description says the fix is in 2.5.0).\nRotate JWTs and node credentials if the instance was exposed while vulnerable.","status":"open","published_at":"2026-10-09T16:17:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:51:28+00:00","updated_at":"2026-10-23T19:51:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:51:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074433-a3999bd78a3b or later (the description says the fix is in 2.5.0).\nRotate JWTs and node credentials if the instance was exposed while vulnerable.","summary":"Nginx UI, a web interface for managing Nginx, leaves its cluster API routes without the OTP step-up check that protects other sensitive actions. An attacker holding a stolen or persisted login token can add, change or delete cluster nodes, read or replace node credentials, and reload or restart Nginx on nodes without a second factor.","category":"package","who_cares":["nginx-ui","go","self-hosted","nginx"],"confidence":0.8,"analyst_note":"Confirm the 2.5.0 release tag matches the Go pseudo-version given in the affected range, and check the GHSA-h246-wpgf-vmq5 advisory for exact mitigation steps.","how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod or the running binary; affected range is up to but not including 1.9.10-0.20260728074433-a3999bd78a3b.\nUnknown whether a specific config flag changes exposure.\nUnknown beyond the version range.","needs_analyst":true,"not_affected_if":["versions-before-2.0.0","versions-at-or-after-fix","no-otp-enabled-users"],"severity_if_unknown":"unknown"},"cost_usd":0.000494,"input_tokens":2380,"output_tokens":511,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107813':33A,44A '-2026':7A,32A,40A,43A,199C '-6706':41A '-84315':8A,200C '/0xjacky/nginx-ui':30A,47A '2.0.0':127C '2.5.0':129C,206C 'action':81B 'add':92B 'api':68B 'api/cluster':10A,131C 'attack':83B 'authent':154C 'authrequir':149C 'chang':93B,175C 'check':76B 'cluster':67B,96B,141C 'cluster-wid':140C 'credenti':102B,174C 'crud':169C 'cve':6A,31A,42A,198C 'delet':95B 'enabl':157C 'expos':133C 'factor':113B,187C 'fix':4A,196C,203C 'fresh':184C 'ghsa':35A 'ghsa-h246-wpgf-vmq5':34A 'github.com':29A,46A 'github.com/0xjacky/nginx-ui':28A,45A 'go':39A,48B 'h246':36A 'hold':84B 'host':56B 'incomplet':3A,195C 'interfac':61B,120C 'invok':178C 'issu':192C 'jwt':164C 'leav':65B 'login':89B 'manag':63B 'mutat':20A,137C 'namespac':136C,176C 'nginx':1A,49B,51B,57B,64B,107B,114C,123C,143C 'nginx-ui':50B 'node':97B,101B,109B,134C,168C,173C 'nodes/reload_nginx':179C 'nodes/restart_nginx':181C 'oper':138C,147C 'otp':23A,72B,156C 'otp-en':155C 'packag':53B 'perform':167C 'persist':88B,163C 'possess':159C 'protect':78B 'read':98B,170C 'reload':104B,144C 'replac':100B,172C 'requiresecuresess':16A,152C 'restart':106B,146C 'rout':69B 'router':11A,132C 'run':21A 'second':112B,186C 'second-factor':185C 'self':55B 'self-host':54B 'sensit':19A,80B 'server':125C 'step':25A,74B,189C 'step-up':24A,73B,188C 'stolen':86B,161C 'therefor':166C 'token':90B 'ui':2A,52B,58B,115C 'user':119C,158C 'version':205C 'vmq5':38A 'web':60B,118C,124C 'wide':142C 'without':22A,70B,110B,151C,182C 'wpgf':37A 'wrap':14A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T16:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6706","url":"https://pkg.go.dev/vuln/GO-2026-6706","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107813","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107813","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107813","severity":null,"published_at":"2026-10-09T16:17:26+00:00","modified_at":"2026-10-20T14:32:08+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}