# github.com/0xJacky/Nginx-UI (Go) vulnerabilities 41 known vulnerabilities (6 critical, 27 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.1.0 (Jan 27, 2022): affected by 31 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 1 since v1.1.0 (Jan 27, 2022) - Registry: https://pkg.go.dev/github.com/0xJacky/Nginx-UI - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-84312: v1.1.0 (through the newest release) - CVE-2026-84360: v1.1.0 (through the newest release) - CVE-2026-84316: v1.1.0 (through the newest release) - CVE-2026-84319: v1.1.0 (through the newest release) - CVE-2026-84317: v1.1.0 (through the newest release) - CVE-2026-84313: v1.1.0 (through the newest release) - CVE-2026-84321: v1.1.0 (through the newest release) - CVE-2026-84314: v1.1.0 (through the newest release) - CVE-2026-84320: v1.1.0 (through the newest release) - CVE-2026-84318: no published release is affected - CVE-2026-84315: v1.1.0 (through the newest release) - CVE-2026-107813: no published release is affected - CVE-2026-107812: no published release is affected - CVE-2026-107811: no published release is affected - CVE-2026-107810: no published release is affected - CVE-2026-107809: no published release is affected - CVE-2026-107808: no published release is affected - CVE-2026-107807: no published release is affected - CVE-2026-107806: no published release is affected - CVE-2026-107805: no published release is affected - CVE-2026-107804: v1.1.0 (through the newest release) - CVE-2026-44015: v1.1.0 (through the newest release) - CVE-2026-42238: v1.1.0 (through the newest release) - CVE-2026-42223: v1.1.0 (through the newest release) - CVE-2026-42222: v1.1.0 (through the newest release) - CVE-2026-42221: v1.1.0 (through the newest release) - CVE-2026-42220: v1.1.0 (through the newest release) - CVE-2026-34403: v1.1.0 (through the newest release) - CVE-2026-33031: v1.1.0 (through the newest release) - CVE-2026-33026: v1.1.0 (through the newest release) - CVE-2026-33027: v1.1.0 (through the newest release) - CVE-2026-33028: v1.1.0 (through the newest release) - CVE-2026-33029: v1.1.0 (through the newest release) - CVE-2026-33030: v1.1.0 (through the newest release) - CVE-2026-33032: v1.1.0 (through the newest release) - CVE-2026-27944: v1.1.0 (through the newest release) - CVE-2024-23828: v1.1.0 (through the newest release) - CVE-2024-23827: v1.1.0 (through the newest release) - CVE-2024-22198: v1.1.0 (through the newest release) - CVE-2024-22196: v1.1.0 (through the newest release) - CVE-2024-22197: v1.1.0 (through the newest release) ## Advisories (41) ### [CVE-2026-84312](https://cve.now/CVE-2026-84312): Nginx UI: Casdoor SSO callback uses a constant \`state\` parameter (login CSRF) - Severity: High 7.1 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0; all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-84360](https://cve.now/CVE-2026-84360): Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools - Severity: High 8.1 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0. - No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-84316](https://cve.now/CVE-2026-84316): Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) - Severity: High 8.8 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0. - No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-84319](https://cve.now/CVE-2026-84319): Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context - Severity: High 8.3 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0. - No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-84317](https://cve.now/CVE-2026-84317): Nginx UI: MCP nginx\_config\_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) - Severity: High 8.8 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0. - No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-84313](https://cve.now/CVE-2026-84313): Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover - Severity: High 8.8 - Published: Oct 12, 2026 - Affected: all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-84321](https://cve.now/CVE-2026-84321): Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable - Severity: Medium 5.4 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0. - No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-84314](https://cve.now/CVE-2026-84314): Nginx UI: Account Takeover via Missing \`RequireSecureSession\` on User Management Endpoint - Severity: High 8.7 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0. - No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-84320](https://cve.now/CVE-2026-84320): Nginx UI: Auto backup name allows path traversal outside validated storage path - Severity: Medium 6.3 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260715121709-f92218e01054. - No fix released. The advisory names 1.9.10-0.20260715121709-f92218e01054 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-84318](https://cve.now/CVE-2026-84318): Nginx UI: MCP \`nginx\_config\_add\` Bypasses Directive Validation — Authenticated RCE - Severity: High 8.8 - Published: Oct 12, 2026 - Affected: from 1.9.10-0.20250506154222-1330888280a2, fixed in 1.9.10-0.20260703131214-23d1934099b0. - No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. ### [CVE-2026-84315](https://cve.now/CVE-2026-84315): Nginx UI OTP secure-session step-up is missing on sensitive mutation routes - Severity: High 8.3 - Published: Oct 12, 2026 - Affected: fixed in 1.9.10-0.20260703131214-23d1934099b0. - No fix released. The advisory names 1.9.10-0.20260703131214-23d1934099b0 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-107813](https://cve.now/CVE-2026-107813): Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up - Severity: High 8.8 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074433-a3999bd78a3b. - No fix released. The advisory names 1.9.10-0.20260728074433-a3999bd78a3b as the fix, which the registry doesn't have yet. ### [CVE-2026-107812](https://cve.now/CVE-2026-107812): Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM - Severity: High 7.5 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728114330-580585516dd8. - No fix released. The advisory names 1.9.10-0.20260728114330-580585516dd8 as the fix, which the registry doesn't have yet. ### [CVE-2026-107811](https://cve.now/CVE-2026-107811): 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser - Severity: High 8.8 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728091109-0ecbd106c37b. - No fix released. The advisory names 1.9.10-0.20260728091109-0ecbd106c37b as the fix, which the registry doesn't have yet. ### [CVE-2026-107810](https://cve.now/CVE-2026-107810): Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied - Severity: High 8.1 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074146-a467ed652591. - No fix released. The advisory names 1.9.10-0.20260728074146-a467ed652591 as the fix, which the registry doesn't have yet. ### [CVE-2026-107809](https://cve.now/CVE-2026-107809): Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs - Severity: High 8.8 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074433-a3999bd78a3b. - No fix released. The advisory names 1.9.10-0.20260728074433-a3999bd78a3b as the fix, which the registry doesn't have yet. ### [CVE-2026-107808](https://cve.now/CVE-2026-107808): Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) - Severity: High 8.1 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074558-95cd21b70814. - No fix released. The advisory names 1.9.10-0.20260728074558-95cd21b70814 as the fix, which the registry doesn't have yet. ### [CVE-2026-107807](https://cve.now/CVE-2026-107807): Nginx UI: Node Secret Credential Exposure via URL Query Parameter - Severity: High 8.8 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20250517140552-daee3ac7ade1, fixed in 1.9.10-0.20260728074433-a3999bd78a3b. - No fix released. The advisory names 1.9.10-0.20260728074433-a3999bd78a3b as the fix, which the registry doesn't have yet. ### [CVE-2026-107806](https://cve.now/CVE-2026-107806): Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite - Severity: Critical 9.4 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20260421071512-7864e378f5cf, fixed in 1.9.10-0.20260728074146-a467ed652591. - No fix released. The advisory names 1.9.10-0.20260728074146-a467ed652591 as the fix, which the registry doesn't have yet. ### [CVE-2026-107805](https://cve.now/CVE-2026-107805): Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage - Severity: High 7.5 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20260729084040-acb59fdd81db, fixed in 1.9.10-0.20260901043436-8c9b9a1aff21. - No fix released. The advisory names 1.9.10-0.20260901043436-8c9b9a1aff21 as the fix, which the registry doesn't have yet. ### [CVE-2026-107804](https://cve.now/CVE-2026-107804): Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout - Severity: Medium 5.3 - Published: Oct 9, 2026 - Affected: from 1.9.10-0.20251005005631-6de168c9454, fixed in 1.9.10-0.20260904075558-e30e331303fc; fixed in 1.9.10-0.20260904075558-e30e331303fc. - No fix released. The advisory names 1.9.10-0.20260904075558-e30e331303fc as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-44015](https://cve.now/CVE-2026-44015): Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services - Severity: High 8.5 - Published: May 12, 2026 - Affected: all versions; through 2.3.4. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-42238](https://cve.now/CVE-2026-42238): Unauthenticated Remote Code Execution via Backup Restore in nginx-ui - Severity: Critical 9.0 - Published: May 4, 2026 - Affected: all versions; fixed in 2.3.8. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-42223](https://cve.now/CVE-2026-42223): nginx-ui: Settings API Exposes Protected Secrets - Severity: Medium 6.5 - Published: May 4, 2026 - Affected: all versions; fixed in 2.3.8. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-42222](https://cve.now/CVE-2026-42222): nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover - Severity: High 8.1 - Published: May 4, 2026 - Affected: versions 2.3.5; all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-42221](https://cve.now/CVE-2026-42221): nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim - Severity: High 8.1 - Published: May 4, 2026 - Affected: from 2.0.0, fixed in 2.3.8; all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-42220](https://cve.now/CVE-2026-42220): nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and… - Severity: Medium 6.5 - Published: May 4, 2026 - Affected: all versions; through 1.9.9. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-34403](https://cve.now/CVE-2026-34403): Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints - Severity: Medium 5.5 - Published: Apr 20, 2026 - Affected: fixed in 1.9.10-0.20260316053337-1a9cd29a3082. - No fix released. The advisory names 1.9.10-0.20260316053337-1a9cd29a3082 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-33031](https://cve.now/CVE-2026-33031): Nginx-UI: Disabled users retain full API access through previously issued bearer tokens - Severity: High 8.6 - Published: Apr 20, 2026 - Affected: fixed in 1.9.10-0.20260314152518-7b66578adb47. - No fix released. The advisory names 1.9.10-0.20260314152518-7b66578adb47 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2026-33026](https://cve.now/CVE-2026-33026): nginx-ui Backup Restore Allows Tampering with Encrypted Backups - Severity: Critical 9.4 - Published: Mar 30, 2026 - Affected: all versions; fixed in 1.9.10-0.20260315015203-f61bcec547c0. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-33027](https://cve.now/CVE-2026-33027): Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory - Severity: Medium 6.9 - Published: Mar 30, 2026 - Affected: through 1.99; all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-33028](https://cve.now/CVE-2026-33028): Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse - Severity: High 7.1 - Published: Mar 30, 2026 - Affected: through 1.99; all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-33029](https://cve.now/CVE-2026-33029): Nginx UI: DoS via Negative Integer Input in Logrotate Interval - Severity: Medium 6.9 - Published: Mar 30, 2026 - Affected: all versions; through 1.99. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-33030](https://cve.now/CVE-2026-33030): Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys - Severity: High 8.8 - Published: Mar 30, 2026 - Affected: through 1.99; all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-33032](https://cve.now/CVE-2026-33032): Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover - Severity: Critical 9.8 - Published: Mar 30, 2026 - Affected: through 1.99; all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2026-27944](https://cve.now/CVE-2026-27944): Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure - Severity: Critical 9.8 - Published: Mar 5, 2026 - Affected: all versions; fixed in 2.3.3. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2024-23828](https://cve.now/CVE-2024-23828): Nginx-UI authenticated RCE through injecting into the application config via CRLF - Severity: High 8.8 - Published: Jan 29, 2024 - Affected: all versions; fixed in 1.9.10-0.20240126104956-d70e37c8575e. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2024-23827](https://cve.now/CVE-2024-23827): Nginx-UI arbitrary file write through the Import Certificate feature - Severity: Critical 9.8 - Published: Jan 29, 2024 - Affected: fixed in 1.9.10-0.20240128060047-8581bdd3c6f4; all versions. - No fix released. The latest release, v1.1.0, is still affected. ### [CVE-2024-22198](https://cve.now/CVE-2024-22198): Authenticated (user role) arbitrary command execution by modifying \`start\_cmd\` setting (GHSL-2023-268) - Severity: High 7.1 - Published: Jan 11, 2024 - Affected: fixed in 1.9.10-0.20231219184941-827e76c46e63. - No fix released. The advisory names 1.9.10-0.20231219184941-827e76c46e63 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2024-22196](https://cve.now/CVE-2024-22196): Authenticated (user role) SQL injection in \`OrderAndPaginate\` (GHSL-2023-270) - Severity: High 7.0 - Published: Jan 11, 2024 - Affected: fixed in 1.9.10-0.20231219195202-ec93ab05a3ec. - No fix released. The advisory names 1.9.10-0.20231219195202-ec93ab05a3ec as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. ### [CVE-2024-22197](https://cve.now/CVE-2024-22197): Authenticated (user role) remote command execution by modifying \`nginx\` settings (GHSL-2023-269) - Severity: High 7.7 - Published: Jan 11, 2024 - Affected: fixed in 1.9.10-0.20231219184941-827e76c46e63. - No fix released. The advisory names 1.9.10-0.20231219184941-827e76c46e63 as the fix, which the registry doesn't have yet. The latest release, v1.1.0, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/0xjacky/nginx-ui Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.