Is CVE-2026-84321 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84321 being exploited in the wild.

How severe is CVE-2026-84321?

Medium severity, with a CVSS score of 5.4, published 12 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0.

Is there a fix for CVE-2026-84321?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84321 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84321?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84321: Nginx UI short token cache bypass after account re-enable

Q: Is there a fix for CVE-2026-84321?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84321 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-84321?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84321 · Severity: medium · CVSS 5.4 · Published 2026-10-12

Nginx UI is a web management interface for Nginx servers. When an administrator disables a user account or revokes authentication tokens, short-lived session tokens can persist in the system's memory cache even though they are removed from the database. If the account is re-enabled before the cache expires, these supposedly-revoked tokens become valid again, allowing an attacker with a stolen token to regain access to the system.

Technologies: github.com/0xJacky/Nginx-UI (Go), Nginx UI. Vendors: Go, Nginx UI.

Quick answers

Is CVE-2026-84321 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84321 being exploited in the wild.
How severe is CVE-2026-84321?: Medium severity, with a CVSS score of 5.4, published 12 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0.
Is there a fix for CVE-2026-84321?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84321 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84321?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0
```

Technical details

The vulnerability exists in the token revocation logic: DeleteUserTokens() removes token records from the database but incompletely clears the cache, leaving standalone short-token entries intact when the long Token field is empty. GetTokenUserByShortToken() checks the cache first, so a stale short token can re-authenticate if the user's account status is later restored to enabled, even though the token should have been permanently revoked. This affects deployments using standalone short tokens for WebSocket or explicit-token authentication.

Affected products

Nginx UI Nginx UI

Identifiers

CVE-2026-84321
GHSA-wq4w-vwvq-q3x9
GO-2026-6801

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.