# CVE-2026-107804: Nginx UI bundled reverse proxy IP allowlist bypass and shared login lockout

Source: https://junglewise.ai/threats/cve-2026-107804-nginx-ui-bundled-reverse-proxy-can-bypass-ip-allowlists-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

CVE-2026-107804 · Severity: medium · CVSS 5.3 · Published 2026-10-09

Nginx UI is a web-based management interface for the Nginx web server. In versions 2.2.0 through 2.5.x, the bundled reverse proxy did not properly track client IP addresses, allowing attackers to bypass IP-based access controls and trigger login lockouts affecting all users behind the proxy.

Technologies: [0xJacky Nginx-UI](https://junglewise.ai/threats/technologies/nginx-ui), [github.com/0xJacky/Nginx-UI (Go)](https://junglewise.ai/threats/technologies/github-com-0xjacky-nginx-ui). Vendors: [0xJacky](https://junglewise.ai/threats/vendors/0xjacky), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-107804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107804 being exploited in the wild.

**How severe is CVE-2026-107804?** Medium severity, with a CVSS score of 5.3, published 9 October 2026.

**Which products and versions are affected?** 0xJacky Nginx-UI 2.2.0 through 2.5.x; github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20251005005631-6de168c9454, < 1.9.10-0.20260904075558-e30e331303fc, SEMVER:introduced=0,fixed=1.9.10-0.20260904075558-e30e331303fc, SEMVER:introduced=1.9.10-0.20251005005631-6de168c9454,fixed=1.9.10-0.20260904075558-e30e331303fc.

**Is there a fix for CVE-2026-107804?** Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260904075558-e30e331303fc or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107804 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107804?** Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260904075558-e30e331303fc or later

  ```sh
  go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260904075558-e30e331303fc
  ```


## Technical details

The vulnerability stems from a trusted-proxy configuration error in the Gin web framework integration. When requests pass through the bundled reverse proxy, the backend treats the loopback proxy address as the client instead of the external source, because no trusted proxy was explicitly configured. This allows bypass of IP allowlist checks for protected management APIs (though authentication is still required), and causes failed login attempts from different sources to be attributed to one loopback address, enabling denial of service to other users through the shared login ban mechanism.

## Affected products

- 0xJacky Nginx UI 2.2.0 through 2.5.x

## Identifiers

- CVE-2026-107804
- GHSA-9h23-53f4-q947
- GO-2026-6724

## Timeline

- 2026-10-09: disclosed

## References

- [https://api.github.com/users/lujiefsi](https://api.github.com/users/lujiefsi)

## Related threats

- [Nginx UI Casdoor SSO login CSRF via constant state parameter](https://junglewise.ai/threats/cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter)
- [Nginx UI OTP secure-session step-up bypass via MCP](https://junglewise.ai/threats/cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp)
- [Nginx UI short token cache bypass after account re-enable](https://junglewise.ai/threats/cve-2026-84321-nginx-ui-standalone-short-tokens-survive-administrative)
- [Nginx UI auto backup path traversal in storage boundary](https://junglewise.ai/threats/cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated)
- [Nginx UI MCP configuration directive validation bypass](https://junglewise.ai/threats/cve-2026-84319-nginx-ui-mcp-configuration-tools-bypass-restricted-directive)