Is CVE-2026-107809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107809 being exploited in the wild.

How severe is CVE-2026-107809?

High severity, with a CVSS score of 8.8, published 9 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728074433-a3999bd78a3b; Nginx UI v2.4.3.

How is CVE-2026-107809 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107809?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107809: Nginx-UI cross-site request forgery via auth cookie fallback

Q: Is there a fix for CVE-2026-107809?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074433-a3999bd78a3b or later. Until then: Enable OTP or Passkey authentication on administrator accounts to require a second factor for sensitive operations. Restrict access to the Nginx-UI management interface to trusted networks or behind an authenticating proxy that enforces additional session validation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107809 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-107809?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107809 · Severity: high · CVSS 8.8 · Published 2026-10-09

Nginx-UI is a web-based management interface for Nginx reverse proxies. A flaw in the authentication middleware allows attackers to trick logged-in administrators into submitting state-changing requests (like modifying Nginx configuration, restarting services, or changing settings) by visiting a malicious website. The browser automatically sends the authentication cookie, and the application accepts it without verifying the request came from the legitimate admin panel.

Technologies: github.com/0xJacky/Nginx-UI (Go), Nginx UI. Vendors: Go, Nginx UI.

Quick answers

Is CVE-2026-107809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107809 being exploited in the wild.
How severe is CVE-2026-107809?: High severity, with a CVSS score of 8.8, published 9 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728074433-a3999bd78a3b; Nginx UI v2.4.3.
Is there a fix for CVE-2026-107809?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074433-a3999bd78a3b or later. Until then: Enable OTP or Passkey authentication on administrator accounts to require a second factor for sensitive operations. Restrict access to the Nginx-UI management interface to trusted networks or behind an authenticating proxy that enforces additional session validation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107809 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107809?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074433-a3999bd78a3b or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260728074433-a3999bd78a3b
```

Enable OTP or Passkey authentication on administrator accounts to require a second factor for sensitive operations. Restrict access to the Nginx-UI management interface to trusted networks or behind an authenticating proxy that enforces additional session validation.

Technical details

The application stores the JWT in a non-HttpOnly `token` cookie and the `getToken` middleware function accepts cookies as a fallback authentication method after checking headers and query parameters. Management endpoints in multiple modules (config, nginx, settings, backup) are protected only by `AuthRequired`, which lacks per-request CSRF tokens or Origin/Referer checks. An attacker can craft cross-site requests to high-impact endpoints like `/api/config/add` that modify Nginx configuration and trigger reloads, exploiting automatic cookie transmission.

Affected products

Nginx-UI Nginx-UI v2.4.3

Identifiers

CVE-2026-107809
GHSA-33rr-wq23-g6gg
GO-2026-6703

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.