github.com/0xJacky/Nginx-UI (Go)
Advisories
76
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.3.8 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/0xJacky/Nginx-UI@v2.3.8 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GO-2026-6773 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) |
High EPSS 0.17% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GO-2026-6773 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) |
High EPSS 0.17% |
all versions | No fix yet |
| GO-2026-6773 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) |
High EPSS 0.17% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-vc32-4gwf-77xp Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools |
High EPSS 0.42% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-vc32-4gwf-77xp Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools |
High EPSS 0.42% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-wq4w-vwvq-q3x9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable |
Medium EPSS 0.21% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-wq4w-vwvq-q3x9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable |
Medium EPSS 0.21% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-jrq7-xrjx-pcfw Nginx UI: Auto backup name allows path traversal outside validated storage path |
Medium EPSS 0.17% |
< 1.9.10-0.20260715121709-f92218e01054 | 1.9.10-0.20260715121709-f92218e01054 |
| GHSA-jrq7-xrjx-pcfw Nginx UI: Auto backup name allows path traversal outside validated storage path |
Medium EPSS 0.17% |
< 1.9.10-0.20260715121709-f92218e01054 | 1.9.10-0.20260715121709-f92218e01054 |
| GHSA-5r62-gj48-897x Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context |
High EPSS 0.28% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-5r62-gj48-897x Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context |
High EPSS 0.28% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-9jww-cxg5-rj9m Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE |
High EPSS 0.82% |
>= 1.9.10-0.20250506154222-1330888280a2, < 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-9jww-cxg5-rj9m Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE |
High EPSS 0.82% |
>= 1.9.10-0.20250506154222-1330888280a2, < 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-76pm-mq2q-9gcr Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) |
High EPSS 0.48% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-76pm-mq2q-9gcr Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) |
High EPSS 0.48% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-cf23-7qxj-xmhr Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) |
High EPSS 0.51% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-cf23-7qxj-xmhr Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) |
High EPSS 0.51% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-5v7c-xpfp-p65m Nginx UI OTP secure-session step-up is missing on sensitive mutation routes |
High EPSS 0.34% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-5v7c-xpfp-p65m Nginx UI OTP secure-session step-up is missing on sensitive mutation routes |
High EPSS 0.34% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-2gc7-j998-5xx6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint |
High EPSS 0.42% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GHSA-2gc7-j998-5xx6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint |
High EPSS 0.42% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GO-2026-6786 Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover |
High EPSS 0.54% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GO-2026-6786 Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover |
High EPSS 0.54% |
< 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
| GO-2026-6786 Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover |
High EPSS 0.54% |
all versions | No fix yet |
| GHSA-h246-wpgf-vmq5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up |
High EPSS 0.30% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
| GHSA-h246-wpgf-vmq5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up |
High EPSS 0.30% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
| GHSA-662p-52hx-cmh2 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM |
High EPSS 0.18% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728114330-580585516dd8 | 1.9.10-0.20260728114330-580585516dd8 |
| GHSA-662p-52hx-cmh2 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM |
High EPSS 0.18% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728114330-580585516dd8 | 1.9.10-0.20260728114330-580585516dd8 |
| GHSA-32gc-wf3m-78w9 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser |
High EPSS 0.43% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b | 1.9.10-0.20260728091109-0ecbd106c37b |
| GHSA-32gc-wf3m-78w9 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser |
High EPSS 0.43% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b | 1.9.10-0.20260728091109-0ecbd106c37b |
| GHSA-p8v3-89rh-jxc7 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied |
High EPSS 0.45% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591 | 1.9.10-0.20260728074146-a467ed652591 |
| GHSA-p8v3-89rh-jxc7 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied |
High EPSS 0.45% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591 | 1.9.10-0.20260728074146-a467ed652591 |
| GHSA-33rr-wq23-g6gg Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs |
High EPSS 0.23% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
| GHSA-33rr-wq23-g6gg Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs |
High EPSS 0.23% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
| GHSA-45gv-9wjv-xh7p Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) |
High EPSS 0.41% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814 | 1.9.10-0.20260728074558-95cd21b70814 |
| GHSA-45gv-9wjv-xh7p Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) |
High EPSS 0.41% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814 | 1.9.10-0.20260728074558-95cd21b70814 |
| GHSA-pvgv-gcp7-v38g Nginx UI: Node Secret Credential Exposure via URL Query Parameter |
High EPSS 0.30% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
| GHSA-pvgv-gcp7-v38g Nginx UI: Node Secret Credential Exposure via URL Query Parameter |
High EPSS 0.30% |
>= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b | 1.9.10-0.20260728074433-a3999bd78a3b |
| GHSA-p393-cf76-4jmr Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite |
High EPSS 0.57% |
>= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 | 1.9.10-0.20260728074146-a467ed652591 |
| GHSA-p393-cf76-4jmr Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite |
High EPSS 0.57% |
>= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 | 1.9.10-0.20260728074146-a467ed652591 |
| GHSA-j3hg-9rp3-5hw9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage |
High EPSS 0.47% |
>= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21 | 1.9.10-0.20260901043436-8c9b9a1aff21 |
| GHSA-j3hg-9rp3-5hw9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage |
High EPSS 0.47% |
>= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21 | 1.9.10-0.20260901043436-8c9b9a1aff21 |
| GHSA-9h23-53f4-q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout |
Medium EPSS 0.22% |
< 1.9.10-0.20260904075558-e30e331303fc | 1.9.10-0.20260904075558-e30e331303fc |
| GHSA-9h23-53f4-q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout |
Medium EPSS 0.22% |
>= 1.9.10-0.20251005005631-6de168c9454, < 1.9.10-0.20260904075558-e30e331303fc | 1.9.10-0.20260904075558-e30e331303fc |
| GHSA-h27v-ph7w-m9fp Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim |
Critical EPSS 1.34% |
all versions | No fix yet |
| GHSA-h27v-ph7w-m9fp Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim |
Critical EPSS 1.34% |
>= 2.0.0, < 2.3.8 | 2.3.8 |
| GHSA-7jrr-xw9c-mj39 Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback |
Medium EPSS 0.30% |
<= 1.9.9 | No fix yet |
| GHSA-7jrr-xw9c-mj39 Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-wr32-99hh-6f35 Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services |
Critical EPSS 0.32% |
all versions | No fix yet |
| GHSA-wr32-99hh-6f35 Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services |
Critical EPSS 0.32% |
<= 2.3.4 | No fix yet |
| GHSA-78mf-482w-62qj Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints |
High EPSS 0.18% |
< 1.9.10-0.20260316053337-1a9cd29a3082 | 1.9.10-0.20260316053337-1a9cd29a3082 |
| GHSA-78mf-482w-62qj Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints |
High EPSS 0.18% |
< 1.9.10-0.20260316053337-1a9cd29a3082 | 1.9.10-0.20260316053337-1a9cd29a3082 |
| GHSA-x234-x5vq-cc2v Nginx-UI: Disabled users retain full API access through previously issued bearer tokens |
High EPSS 0.27% |
< 1.9.10-0.20260314152518-7b66578adb47 | 1.9.10-0.20260314152518-7b66578adb47 |
| GHSA-x234-x5vq-cc2v Nginx-UI: Disabled users retain full API access through previously issued bearer tokens |
High EPSS 0.27% |
< 1.9.10-0.20260314152518-7b66578adb47 | 1.9.10-0.20260314152518-7b66578adb47 |
| GHSA-h6c2-x2m2-mwhf nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover |
Critical EPSS 35.27% |
<= 1.99 | No fix yet |
| GHSA-h6c2-x2m2-mwhf nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover |
Critical EPSS 35.27% |
all versions | No fix yet |
| GHSA-cp8r-8jvw-v3qg nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval |
Medium EPSS 0.98% |
<= 1.99 | No fix yet |
| GHSA-cp8r-8jvw-v3qg nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval |
Medium EPSS 0.98% |
all versions | No fix yet |
| GHSA-m468-xcm6-fxg4 nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse |
High EPSS 0.55% |
all versions | No fix yet |
| GHSA-m468-xcm6-fxg4 nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse |
High EPSS 0.55% |
<= 1.99 | No fix yet |
| GHSA-m8p8-53vf-8357 Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation |
Medium EPSS 0.41% |
<= 1.99 | No fix yet |
| GHSA-m8p8-53vf-8357 Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation |
Medium EPSS 0.41% |
all versions | No fix yet |
| GHSA-fhh2-gg7w-gwpq nginx-ui Backup Restore Allows Tampering with Encrypted Backups |
Critical EPSS 0.33% |
all versions | No fix yet |
| GHSA-fhh2-gg7w-gwpq nginx-ui Backup Restore Allows Tampering with Encrypted Backups |
Critical EPSS 0.33% |
< 1.9.10-0.20260315015203-f61bcec547c0 | 1.9.10-0.20260315015203-f61bcec547c0 |
| GHSA-g9w5-qffc-6762 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure |
Critical EPSS 22.84% |
all versions | No fix yet |
| GHSA-g9w5-qffc-6762 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure |
Critical EPSS 22.84% |
< 2.3.3 | 2.3.3 |
| GHSA-qcjq-7f7v-pvc8 Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF |
High EPSS 1.05% |
all versions | No fix yet |
| GHSA-qcjq-7f7v-pvc8 Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF |
High EPSS 1.05% |
< 1.9.10-0.20240126104956-d70e37c8575e | 1.9.10-0.20240126104956-d70e37c8575e |
| GHSA-xvq9-4vpv-227m Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature |
Critical EPSS 0.70% |
all versions | No fix yet |
| GHSA-xvq9-4vpv-227m Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature |
Critical EPSS 0.70% |
< 1.9.10-0.20240128060047-8581bdd3c6f4 | 1.9.10-0.20240128060047-8581bdd3c6f4 |
| GHSA-8r25-68wm-jw35 Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) |
High EPSS 4.06% |
< 1.9.10-0.20231219184941-827e76c46e63 | 1.9.10-0.20231219184941-827e76c46e63 |
| GHSA-8r25-68wm-jw35 Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) |
High EPSS 4.06% |
< 1.9.10-0.20231219184941-827e76c46e63 | 1.9.10-0.20231219184941-827e76c46e63 |
| GHSA-pxmr-q2x3-9x9m Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) |
High EPSS 1.54% |
< 1.9.10-0.20231219184941-827e76c46e63 | 1.9.10-0.20231219184941-827e76c46e63 |
| GHSA-pxmr-q2x3-9x9m Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) |
High EPSS 1.54% |
< 1.9.10-0.20231219184941-827e76c46e63 | 1.9.10-0.20231219184941-827e76c46e63 |
| GHSA-h374-mm57-879c Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) |
Medium EPSS 0.58% |
< 1.9.10-0.20231219195202-ec93ab05a3ec | 1.9.10-0.20231219195202-ec93ab05a3ec |
| GHSA-h374-mm57-879c Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) |
Medium EPSS 0.58% |
< 1.9.10-0.20231219195202-ec93ab05a3ec | 1.9.10-0.20231219195202-ec93ab05a3ec |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor