Is CVE-2026-107804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107804 being exploited in the wild.

How severe is CVE-2026-107804?

Medium severity, with a CVSS score of 5.3, published 9 October 2026.

Which products and versions are affected?

0xJacky Nginx-UI 2.2.0 through 2.5.x; github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20251005005631-6de168c9454, < 1.9.10-0.20260904075558-e30e331303fc, SEMVER:introduced=0,fixed=1.9.10-0.20260904075558-e30e331303fc, SEMVER:introduced=1.9.10-0.20251005005631-6de168c9454,fixed=1.9.10-0.20260904075558-e30e331303fc.

Is there a fix for CVE-2026-107804?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260904075558-e30e331303fc or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107804 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107804?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107804: Nginx UI bundled reverse proxy IP allowlist bypass and shared login lockout

Q: Is there a fix for CVE-2026-107804?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260904075558-e30e331303fc or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107804 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-107804?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107804 · Severity: medium · CVSS 5.3 · Published 2026-10-09

Nginx UI is a web-based management interface for the Nginx web server. In versions 2.2.0 through 2.5.x, the bundled reverse proxy did not properly track client IP addresses, allowing attackers to bypass IP-based access controls and trigger login lockouts affecting all users behind the proxy.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2026-107804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107804 being exploited in the wild.
How severe is CVE-2026-107804?: Medium severity, with a CVSS score of 5.3, published 9 October 2026.
Which products and versions are affected?: 0xJacky Nginx-UI 2.2.0 through 2.5.x; github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20251005005631-6de168c9454, < 1.9.10-0.20260904075558-e30e331303fc, SEMVER:introduced=0,fixed=1.9.10-0.20260904075558-e30e331303fc, SEMVER:introduced=1.9.10-0.20251005005631-6de168c9454,fixed=1.9.10-0.20260904075558-e30e331303fc.
Is there a fix for CVE-2026-107804?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260904075558-e30e331303fc or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107804 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107804?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260904075558-e30e331303fc or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260904075558-e30e331303fc
```

Technical details

The vulnerability stems from a trusted-proxy configuration error in the Gin web framework integration. When requests pass through the bundled reverse proxy, the backend treats the loopback proxy address as the client instead of the external source, because no trusted proxy was explicitly configured. This allows bypass of IP allowlist checks for protected management APIs (though authentication is still required), and causes failed login attempts from different sources to be attributed to one loopback address, enabling denial of service to other users through the shared login ban mechanism.

Affected products

0xJacky Nginx UI 2.2.0 through 2.5.x

Identifiers

CVE-2026-107804
GHSA-9h23-53f4-q947
GO-2026-6724

Timeline

2026-10-09: disclosed

References

https://api.github.com/users/lujiefsi

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.