CVE-2026-107804

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.2.0 through 2.5.x

Description The bundled reverse proxy fails to preserve the external client identity used by Gin because the backend lacks a trusted proxy configuration. This causes the backend to treat the local proxy peer as the client. Consequently, management API requests are identified as loopback and may bypass IP allowlist restrictions, although valid credentials are still required. Additionally, failed login attempts from multiple external clients are attributed to a single loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication, which denies login access to other users without invalidating existing sessions.

Recommendations Upgrade to version 2.6.0 or later.