Nginx UI CVE-2026-107804

Applies to Nginx UI versions 2.2.0 up to (but not including) 2.6.0 ONLY when the application is reached through its bundled reverse proxy and the backend has no trusted-proxy configuration, so Gin cannot derive the real client IP and attributes all traffic to loopback. The DoS path (shared login ban for password/OTP) requires no authentication and no user interaction. The separate IP-allowlist loopback-exception bypass is strongly LIMITED because valid credentials are still required; the ban itself is temporary and does NOT invalidate existing sessions, so it is a transient availability impact rather than account takeover. Deployments that already set trusted proxies or do not front the UI with the bundled proxy are not affected.

This is a genuinely medium/low-priority issue despite a web-facing attack surface. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) is internally consistent with the description: unauthenticated and network-reachable, but with ZERO confidentiality and integrity impact and only LOW availability impact. The real-world effect is a temporary, shared authentication ban (a denial-of-service against the login flow) that does NOT invalidate existing sessions and does NOT grant access - valid credentials are still required for the loopback allowlist bypass path. No EPSS score, no CISA KEV listing, and no public POC were provided; the only 'source code evidence' is the vendor's own fix commit, not exploit code. There is no conflict among the signals, but note the input Tags label this 'Information Disclosure', which contradicts the CVSS (C:N) and the CWE - this is an origin-validation/DoS issue, not disclosure. Net: a legitimate availability nuisance worth patching during normal cycles, not an emergency.

An attacker reachable over the network sends repeated failed login attempts (password or OTP) to an Nginx UI instance deployed behind its bundled reverse proxy without trusted-proxy configuration. Because every external client is attributed to the loopback address, the failures accumulate against one shared identity and trip the temporary login ban, locking out legitimate operators from authenticating. No public exploit code was identified at time of analysis; the only available artifact is the vendor fix commit.