Vulnerability GO-2026-6706
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
October 19, 2026 at 09:08 PM UTC
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI
>=1.9.10-0.20250517140552-daee3ac7ade1 <1.9.10-0.20260728074433-a3999bd78a3b
>=1.9.10-0.20250517140552-daee3ac7ade1 <1.9.10-0.20260728074433-a3999bd78a3b
Summary
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI
Details
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
5 hours ago
Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI
v1.1.0 - v1.9.9 GO-2026-6773
v1.1.0 - v1.9.9 GO-2026-6773
Unknown
5 hours ago
TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
v1.1.0 - v1.9.9 GO-2026-6786
v1.1.0 - v1.9.9 GO-2026-6786
Unknown
5 hours ago
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI
v1.1.0 - v1.9.9 GO-2026-6771
v1.1.0 - v1.9.9 GO-2026-6771
Unknown
5 hours ago
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI
v1.1.0 - v1.9.9 GO-2026-6774
v1.1.0 - v1.9.9 GO-2026-6774
Unknown
5 hours ago
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI
v1.1.0 - v1.9.9 GO-2026-6775
v1.1.0 - v1.9.9 GO-2026-6775
Impacted packages
Timeline
Published
5 hours ago
October 19, 2026 at 09:08 PM UTC
Fixed (v1.9.10-0.20260728074433-a3999bd78a3b)
2 months ago
July 28, 2026 at 07:44 AM UTC
Last Modified
4 hours ago
October 19, 2026 at 09:31 PM UTC