Web User Interface Vulnerability in Nginx from 2.2.0 to 2.6.0

CVE-2026-107804

What is CVE-2026-107804?

The Nginx UI is subject to a vulnerability in its reverse proxy configuration, affecting versions 2.2.0 through 2.6.0. This flaw arises because the backend does not maintain a trusted proxy setup, leading to misattribution of management requests to the loopback interface. As a result, unauthorized users may trigger a temporary login ban by causing multiple failed authentication attempts, utilizing valid credentials. This issue has been addressed in version 2.6.0, ensuring better client identity management and preventing login-related misattributions.

References