Live › vulnerability › CVE-2026-84315
Go to dashboardNginx UI, a web interface for managing Nginx, skips its OTP/passkey step-up check on several sensitive routes such as backups, DNS credentials, certificates and Nginx control. An attacker holding a stolen logged-in session can change those settings without the second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | < 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
Check the version of github.com/0xJacky/Nginx-UI in your go.mod or the running binary; versions before 1.9.10-0.20260703131214-23d1934099b0 are affected per the Go vulnerability database.
1.9.10-0.20260703131214-23d1934099b0 or later (the description says 2.4.1 or later)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-84315")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.