Is CVE-2026-84314 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84314 being exploited in the wild.

How severe is CVE-2026-84314?

High severity, with a CVSS score of 4, published 12 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0; Nginx UI <unknown.

Is there a fix for CVE-2026-84314?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84314 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84314?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84314: nginx-ui account takeover via missing 2FA on user password change

Q: Is there a fix for CVE-2026-84314?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84314 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-84314?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84314 · Severity: high · CVSS 4 · Published 2026-10-12

nginx-ui is a web-based administration interface for the nginx web server. An authenticated attacker can change any user's password, including the initial admin account, without providing 2FA verification. This allows complete account takeover of the admin account and locks out the legitimate administrator.

Technologies: github.com/0xJacky/Nginx-UI (Go), Nginx UI. Vendors: Go, Nginx UI.

Quick answers

Is CVE-2026-84314 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84314 being exploited in the wild.
How severe is CVE-2026-84314?: High severity, with a CVSS score of 4, published 12 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0; Nginx UI <unknown.
Is there a fix for CVE-2026-84314?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84314 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84314?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0
```

Technical details

The POST /api/users/:id endpoint for password changes is missing the RequireSecureSession middleware that enforces 2FA verification, while the self-password change endpoint correctly implements it. Any authenticated user can exploit this to change another user's password by sending a JSON request with a new password, bypassing all 2FA protections even if enabled on the target account.

Affected products

nginx-ui nginx-ui <unknown

Identifiers

CVE-2026-84314
GHSA-2gc7-j998-5xx6
GO-2026-6771

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.