| Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management EndpointCVE-2026-84314 · GHSA-2GC7-J998-5XX6Version ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeoverCVE-2026-84313 · GHSA-GFRC-G87H-7H5WVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)CVE-2026-84312 · GHSA-44XR-MRHH-QM78Version ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI OTP secure-session step-up is missing on sensitive mutation routesCVE-2026-84315 · GHSA-5V7C-XPFP-P65MVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Node Secret Credential Exposure via URL Query ParameterCVE-2026-107807 · GHSA-PVGV-GCP7-V38GVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableCVE-2026-84321 · GHSA-WQ4W-VWVQ-Q3X9Version ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
Medium
|
Fix reported |
|
| Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCECVE-2026-84318 · GHSA-9JWW-CXG5-RJ9MVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)CVE-2026-107808 · GHSA-45GV-9WJV-XH7PVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUserCVE-2026-107811 · GHSA-32GC-WF3M-78W9Version ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwriteCVE-2026-107806 · GHSA-P393-CF76-4JMRVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
Critical
|
Fix reported |
|
| Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIsCVE-2026-107809 · GHSA-33RR-WQ23-G6GGVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)CVE-2026-84317 · GHSA-76PM-MQ2Q-9GCRVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)CVE-2026-84316 · GHSA-CF23-7QXJ-XMHRVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration toolsCVE-2026-84360 · GHSA-VC32-4GWF-77XPVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker contextCVE-2026-84319 · GHSA-5R62-GJ48-897XVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutCVE-2026-107804 · GHSA-9H23-53F4-Q947Version ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
Medium
|
Fix reported |
|
| Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storageCVE-2026-107805 · GHSA-J3HG-9RP3-5HW9Version ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMCVE-2026-107812 · GHSA-662P-52HX-CMH2Version ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-upCVE-2026-107813 · GHSA-H246-WPGF-VMQ5Version ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
High
|
Fix reported |
|
| Nginx UI: Auto backup name allows path traversal outside validated storage pathCVE-2026-84320 · GHSA-JRQ7-XRJX-PCFWVersion ranges need review. |
github.com/0xJacky/Nginx-UI |
Go |
Medium
|
Fix reported |
|
