CVE-2026-107804: Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

October 9, 2026

In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in forwarding headers.

References

github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf
github.com/0xJacky/nginx-ui/releases/tag/v2.6.0
github.com/0xJacky/nginx-ui/security/advisories/GHSA-9h23-53f4-q947
github.com/advisories/GHSA-9h23-53f4-q947
nvd.nist.gov/vuln/detail/CVE-2026-107804

Code Behaviors & Features

Detect and mitigate CVE-2026-107804 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →