Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · GHSA-h246-wpgf-vmq5

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

CVSS 8.8 HighEPSS 0.0031 · 23rd percentile

Published by the GitHub Advisory Database at 9 Oct 2026, 17:08 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
github.com/0xJacky/Nginx-UIGo>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b1.9.10-0.20260728074433-a3999bd78a3b
Identifiers
GHSA-h246-wpgf-vmq5 · CVE-2026-107813 · GO-2026-6706
Weakness (CWE)
CWE-862
Tags
Published
9 Oct 2026
Updated
19 Oct 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

Nginx UI versions from 1.9.10-0.20250517140552-daee3ac7ade1 before 1.9.10-0.20260728074433-a3999bd78a3b are affected. The cluster management routes (node add, edit and delete, cluster-wide nginx reload and restart, and namespace changes) lack the secure-session step-up that the earlier fix added to other routes. An authenticated user holding a stolen or persisted JWT, without a fresh secure session, can change cluster nodes, read and rewrite node token secrets, and trigger cluster-wide nginx reloads or restarts. Upgrade to 1.9.10-0.20260728074433-a3999bd78a3b or later.

Written 1 Nov 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
8.8 High 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CNA (GitHub_M)
  • CISA KEV Not listed.
  • EPSS 0.0031, the 23rd percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 31 Oct 2026, 14:11 UTC First seen by agentprime
  2. 31 Oct 2026, 14:11 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.