Is CVE-2026-107811 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107811 being exploited in the wild.

How severe is CVE-2026-107811?

High severity, with a CVSS score of 8.8, published 9 October 2026.

Which products and versions are affected?

0xJacky Nginx-UI v2.4.2; github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728091109-0ecbd106c37b.

How is CVE-2026-107811 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107811?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107811: nginx-ui credential exposure and cross-node privilege escalation

Q: Is there a fix for CVE-2026-107811?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728091109-0ecbd106c37b or later. Until then: Restrict cluster node management endpoints to administrator-only authorization checks instead of allowing all authenticated users to access them. Alternatively, redact or completely omit the Token field from node API responses and use a separate secure channel for node-to-node credential exchange, rather than exposing shared secrets through the HTTP management API. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-107811 · Severity: high · CVSS 8.8 · Published 2026-10-09

nginx-ui is a management interface for Nginx web servers that can run in a clustered configuration. The application leaks cluster node authentication tokens to any logged-in user through its API, and then trusts those tokens to automatically elevate any request to administrative privileges on remote nodes. An attacker with a basic user account can read these tokens and use them to remotely restart services, reload configurations, or perform other administrative actions across the cluster without needing actual admin credentials.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2026-107811 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107811 being exploited in the wild.
How severe is CVE-2026-107811?: High severity, with a CVSS score of 8.8, published 9 October 2026.
Which products and versions are affected?: 0xJacky Nginx-UI v2.4.2; github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728091109-0ecbd106c37b.
Is there a fix for CVE-2026-107811?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728091109-0ecbd106c37b or later. Until then: Restrict cluster node management endpoints to administrator-only authorization checks instead of allowing all authenticated users to access them. Alternatively, redact or completely omit the Token field from node API responses and use a separate secure channel for node-to-node credential exchange, rather than exposing shared secrets through the HTTP management API.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107811 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107811?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728091109-0ecbd106c37b or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260728091109-0ecbd106c37b
```

Restrict cluster node management endpoints to administrator-only authorization checks instead of allowing all authenticated users to access them. Alternatively, redact or completely omit the Token field from node API responses and use a separate secure channel for node-to-node credential exchange, rather than exposing shared secrets through the HTTP management API.</anigation> </invoke>

Technical details

The vulnerability combines two flaws: (1) node endpoints mounted in the authenticated API route group return unredacted node objects including a Token field used for node-to-node authentication (model/node.go, api/cluster/node.go), and (2) middleware treats possession of the correct X-Node-Secret header value as sufficient to bypass JWT authentication and set the user context to initUser (middleware.go:73-103). An authenticated local or network attacker can call GET /api/nodes to leak the shared node secret, then send requests to remote cluster nodes with the leaked token in the X-Node-Secret header to gain administrative access and invoke sensitive operations like POST /api/system/restart.

Affected products

0xJacky nginx-ui v2.4.2

Identifiers

CVE-2026-107811
GHSA-32gc-wf3m-78w9
GO-2026-6702

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.