CVE-2026-107804

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

MEDIUM 5.3

En bref

Source: NVD
EPSS: EPSS 0.22 % · centile 13 (2026-10-28)
État: PUBLISHED
Publiée: 2026-10-09 14:49 UTC
Mise à jour: 2026-10-09 15:09 UTC
Attribuée par: GitHub_M
Statut NVD: Awaiting Analysis

Description

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.

Faiblesses (CWE)

CWE-346 — Erreur de validation de l'origine

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	GitHub_M
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	NVD · security-advisories@github.com (Secondary)

Avis

GHSA-9h23-53f4-q947 — Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
GO-2026-6724 — Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI

Références européennes

ENISA EUVD · EUVD-2026-95817
GCVE · GCVE-0-2026-107804

Produits affectés

Produit	Versions
0xJacky · nginx-ui	affected >= 2.2.0, < 2.6.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD