Patch Forecast
Amber warning
Patch this week.

CVE-2026-107812 · GHSA-662p-52hx-cmh2

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Risk score
66/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.2%
Published
9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and m…
Affected
github.com/0xJacky/Nginx-UI (go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728114330-580585516dd8
Fix
Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728114330-580585516dd8 or later.
Exploitation
Public proof of concept

Story map

Story map: github.com/0xJacky/Nginx-UITHE FLAWSTHE FIXCVE-2026-107812Nginx UI: Self-upgrade runs anunsigned binary verified only bya same-origin digest → RCE via…CVSS 7.5 · EPSS 0%CVE-2026-107808Nginx UI: Authenticationbypass: password login does notenforce a passkey-only second…CVSS 8.1 · EPSS 0%CVE-2026-107809Nginx-UI AuthRequired tokencookie fallback enables CSRFagainst management APIsCVSS 8.8 · EPSS 0%CVE-2026-1078110xJacky/nginx-ui /api/nodesLeaks Cluster Node Tokens andAllows Cross-Node…CVSS 8.8 · EPSS 0%Upgrade…2.5.0or later on your release lineWho is exposedgithub.com/0xJacky/Nginx-UI(go) >=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95…AMBER · PATCH THIS WEEKgithub.com/0xJacky/Nginx-UINginx UI is a web user interfacefor the Nginx web server. From2.0.0 until 2.5.0, POST /api/loginchecks EnabledOTP but does notrequire a WebAuthn assertionwhen EnabledPasskey is true andno TOTP secret is configured. A…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-494 (CWE-494)11 other warnings in 30 days →Same productEarlier github.com/0xJacky/Nginx-UI warnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/0xJacky/Nginx-UI: Amber, patch this week. Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2…

The flaws

  • CVE-2026-107812: Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107808: Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) (CVSS 8.1 · EPSS 0%)
  • CVE-2026-107809: Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs (CVSS 8.8 · EPSS 0%)
  • CVE-2026-107811: 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser (CVSS 8.8 · EPSS 0%)

The fix

Upgrade github.com/0xJacky/Nginx-UI: 2.5.0 or later on your release line

Who is exposed: github.com/0xJacky/Nginx-UI (go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: nginx, Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/0xJacky/Nginx-UIgo>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728114330-580585516dd81.9.10-0.20260728114330-580585516dd8

References

Original description

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.

Last activity 9 Oct 2026. Patch Forecast updates every hour.