{"id":"CVE-2026-84315","kind":"vulnerability","aliases":["CVE-2026-84315","GHSA-5v7c-xpfp-p65m","GO-2026-6775"],"related":[],"title":"Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.","summary":"Nginx UI, a web interface for managing Nginx, skips its OTP/passkey step-up check on several sensitive routes such as backups, DNS credentials, certificates and Nginx control. An attacker holding a stolen logged-in session can change those settings without the second factor.","severity":"high","cvss":8.3,"epss":0.00275,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260703131214-23d1934099b0"],"affected":"< 1.9.10-0.20260703131214-23d1934099b0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["no-exposed-admin-ui","users-without-otp"],"how_to_check":"Check the version of github.com/0xJacky/Nginx-UI in your go.mod or the running binary; versions before 1.9.10-0.20260703131214-23d1934099b0 are affected per the Go vulnerability database.","fix":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260703131214-23d1934099b0 or later (the description says 2.4.1 or later).\nAfter upgrading, rotate sessions for users who have OTP enabled if exposure is suspected.","status":"open","published_at":"2026-10-12T21:17:21+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:42+00:00","updated_at":"2026-10-23T19:52:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:52:42Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260703131214-23d1934099b0 or later (the description says 2.4.1 or later).\nAfter upgrading, rotate sessions for users who have OTP enabled if exposure is suspected.","summary":"Nginx UI, a web interface for managing Nginx, skips its OTP/passkey step-up check on several sensitive routes such as backups, DNS credentials, certificates and Nginx control. An attacker holding a stolen logged-in session can change those settings without the second factor.","category":"package","who_cares":["nginx-ui","go","self-hosted","nginx"],"confidence":0.7,"analyst_note":"Sources disagree on the fixed version (module pseudo-version 1.9.10-0.20260703131214-23d1934099b0 vs. text saying 2.4.1); confirm the correct release at https://pkg.go.dev/vuln/GO-2026-6775 and the GHSA advisory.","how_to_check":"Check the version of github.com/0xJacky/Nginx-UI in your go.mod or the running binary; versions before 1.9.10-0.20260703131214-23d1934099b0 are affected per the Go vulnerability database.\nunknown","needs_analyst":true,"not_affected_if":["users-without-otp","no-exposed-admin-ui"],"severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2280,"output_tokens":485,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':21A,29A,32A '-6775':30A '-84315':22A,33A '/0xjacky/nginx-ui':19A,36A '2.4.1':105C,179C '5v7c':25A 'acm':154C 'action':136C 'alter':145C 'appli':110C 'attack':75B 'authent':114C,139C 'autom':163C 'automat':146C 'backup':67B,147C 'certif':70B,152C 'chang':84B 'check':60B 'complet':165C 'control':73B,157C 'creat':143C 'credenti':69B,149C 'cve':20A,31A 'dns':68B,148C 'enabl':121C 'even':117C 'expect':124C 'factor':90B 'fix':176C 'fresh':128C 'ghsa':24A 'ghsa-5v7c-xpfp-p65m':23A 'github.com':18A,35A 'github.com/0xjacky/nginx-ui':17A,34A 'go':28A,37B 'hold':76B 'host':45B 'id':133C 'interfac':50B,97C 'issu':174C 'log':80B 'logged-in':79B 'manag':52B 'miss':11A 'multipl':113C 'mutat':14A,115C 'nginx':1A,38B,40B,46B,53B,72B,91C,100C,106C,156C 'nginx-ui':39B 'otp':3A,120C,167C 'otp-en':119C 'otp/passkey':56B 'p65m':27A 'packag':42B 'passkey':169C 'present':126C 'prior':103C 'record':151C 'requiresecuresess':111C 'rout':15A,64B,116C 'second':89B 'secur':5A,131C 'secure-sess':4A 'self':44B 'self-host':43B 'sensit':13A,63B,135C 'server':102C 'session':6A,82B,132C,140C 'set':86B,158C 'sever':62B 'site':160C 'skip':54B 'step':8A,58B,171C 'step-up':7A,57B,170C 'stolen':78B,138C 'stream':162C 'therefor':142C 'though':118C 'ui':2A,41B,47B,92C,107C 'user':96C,122C,155C 'version':178C 'web':49B,95C,101C 'without':87B,164C 'x':130C 'x-secure-session-id':129C 'xpfp':26A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T21:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6775","url":"https://pkg.go.dev/vuln/GO-2026-6775","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84315","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84315","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-84315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84315","severity":null,"published_at":"2026-10-12T21:17:21+00:00","modified_at":"2026-10-13T16:17:23+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}