Is CVE-2026-79316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79316 being exploited in the wild.

How severe is CVE-2026-79316?

High severity, with a CVSS score of 7.6, published 21 September 2026.

Is there a fix for CVE-2026-79316?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-79316 attacked?

It is attacked over the network.

Am I affected by CVE-2026-79316?

Check whether you run Vaxilu X-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79316: x-ui improper access control in Xray configuration template

CVE-2026-79316 · Severity: high · CVSS 7.6 · Published 2026-09-21

x-ui is a web panel that manages Xray proxy services for remote administration. An authenticated user can modify the Xray configuration template to rebind the management interface from localhost to any network address, then trigger a restart to expose the administrative service to the network. This allows any user with panel login credentials to access or manipulate the proxy service management interface beyond its intended local-only scope.

Technologies: Vaxilu X-Ui. Vendors: Vaxilu.

Quick answers

Is CVE-2026-79316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79316 being exploited in the wild.
How severe is CVE-2026-79316?: High severity, with a CVSS score of 7.6, published 21 September 2026.
Which products and versions are affected?: Vaxilu X-Ui 0.3.2.
Is there a fix for CVE-2026-79316?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79316 attacked?: It is attacked over the network.
Am I affected by CVE-2026-79316?: Check whether you run Vaxilu X-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from improper access control (CWE-284) combined with unsafe configuration handling. An authenticated panel user can edit the Xray configuration template in settings (which performs only JSON syntax validation, not security constraints) and trigger a panel restart; the template is then applied verbatim to regenerate the runtime configuration, causing the management gRPC interface to bind to a non-loopback address. An attacker with valid panel credentials can exploit this without administrator privileges, requiring only a restart event to activate the malicious configuration.

Affected products

vaxilu x-ui 0.3.2

Timeline

2026-09-21: disclosed
2026-08-04: other: Report date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.