PkgSeer

Vulnerability GO-2026-6702

Unknown

5 hours ago

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI

>=1.9.10-0.20250517140552-daee3ac7ade1 <1.9.10-0.20260728091109-0ecbd106c37b

Summary

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI

Details

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6773

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6786

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6771

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6774

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6775

View all vulnerabilities for these packages

Impacted packages

github.com/0xJacky/Nginx-UI

Timeline

Published

5 hours ago

Fixed (v1.9.10-0.20260728091109-0ecbd106c37b)

2 months ago

Last Modified

4 hours ago