CVE-2026-107804: Nginx UI Bundled Reverse Proxy Can Bypass Vulnerability
MODERATECVE-2026-107804 is a MODERATE (CVSS 5.3) bundled reverse proxy can bypass vulnerability (CWE-346: Origin Validation Error) affecting Nginx UI libraries in the Go ecosystem. The issue involves bundled reverse proxy can bypass ip allowlists and enable shared login lockout. Remediation is available by upgrading affected packages to version 1.9.10-0.20260904075558-e30e331303fc.
CVE-2026-107804 at a Glance
Security Impact
CVSS: 5.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
How to Fix CVE-2026-107804
To remediate this vulnerability, upgrade all affected Nginx UI dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260904075558-e30e331303fcRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/0xJacky/Nginx-UIHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-107804, inspect your project dependencies for Nginx UI:
inspect dependencies for github.com/0xJacky/Nginx-UIAnalyze the terminal output to locate any version of Nginx UI in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.9.10-0.20260904075558-e30e331303fc), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-346: Origin Validation Error, where the product does not properly verify that the source of data or communication is valid. In Nginx UI, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-107804 Affected Nginx UI Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/0xJacky/Nginx-UI
|
Go |
≥ 1.9.10-0.20251005005631-6de168c9454
< 1.9.10-0.20260904075558-e30e331303fc
|
1.9.10-0.20260904075558-e30e331303fc
|
References
Frequently Asked Questions
What is CVE-2026-107804?
Which Nginx UI versions are affected?
What version fixes CVE-2026-107804?
Is github.com/0xJacky/Nginx-UI affected?
What is the CVSS score of CVE-2026-107804?
What CWE is associated with CVE-2026-107804?
How can I check Go dependencies for CVE-2026-107804?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9h23-53f4-q947",
"modified" : "2026-10-09T20:57:05Z",
"published" : "2026-10-09T20:57:05Z",
"aliases" : [ "CVE-2026-107804" ],
"summary" : "Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout",
"details" : "## Summary\n\nIn Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in forwarding headers.\n\n## Impact\n\nThis has two distinct effects in bundled-proxy deployments:\n\n* **IP allowlist enforcement:** management API requests forwarded by the bundled proxy were identified as loopback and could pass the loopback exception even when the external source was not in the configured allowlist. Protected management operations still required valid credentials; this did not grant unauthenticated administrator access.\n* **Login availability:** failed login attempts from different external sources were attributed to one loopback address. An unauthenticated attacker could therefore trigger the shared temporary login-ban threshold and deny password or OTP login to other users behind the proxy until the ban expired. Existing authenticated sessions were not invalidated.\n\n## Remediation\n\nUpgrade to Nginx UI 2.6.0 or later. The fix explicitly trusts only the intended bundled proxy, validates configured trusted proxies, uses the resolved client address consistently, and fails closed when an IP allowlist is enabled but the client address is invalid.\n\nFix commit: https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/0xJacky/Nginx-UI"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.9.10-0.20251005005631-6de168c9454"
}, {
"fixed" : "1.9.10-0.20260904075558-e30e331303fc"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9h23-53f4-q947"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-107804"
}, {
"type" : "WEB",
"url" : "https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/0xJacky/nginx-ui"
}, {
"type" : "WEB",
"url" : "https://github.com/0xJacky/nginx-ui/releases/tag/v2.6.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-346" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-10-09T20:57:05Z",
"nvd_published_at" : "2026-10-09T15:17:09Z"
}
}