6 matches found
PT-2026-118040
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GHSA-9H23-53F4-Q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...
CVE-2026-107804 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowli...
CVE-2026-107804 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowli...
CVE-2026-107804 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowli...