EUVD-2026-84205
GHSA-x7jv-2m23-2ch3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to x-ui panel (low-priv)
-
DeliveryModify xray config template via settings
-
ExploitTrigger panel restart
-
ExecutiongRPC service rebinds off loopback
-
ImpactManagement interface reachable from network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid authenticated access to the x-ui panel (any panel user, low privilege - PR:L). The attacker edits the xray configuration template through the settings interface and triggers a panel restart, which regenerates the xray management gRPC listener so it binds to a non-loopback address instead of the default loopback-only binding. Limiting factors: exploitation is gated by needing working panel credentials and the ability to trigger a restart; the flaw only matters where the panel has users who should not control the network-exposure boundary, and full impact requires a second attacker able to reach the newly-exposed gRPC address on the network. |
| Impact | Signals are mixed and lean toward moderate-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, base 7.6) describes a low-privilege authenticated attacker, which matches the description ('any authenticated panel user'). EPSS is very low at 0.15% (5th percentile), the CVE is NOT in CISA KEV, and there is no vendor patch reference, so exploitation is theoretical rather than observed. A third-party writeup exists (TraceLoom repo) but it is analysis/documentation, not confirmed weaponized exploit code - treat as no public exploit identified rather than active exploitation. The vendor-assigned C:H is generous for the described impact: the direct effect is exposing the xray management gRPC service beyond loopback, which is fundamentally an exposure/access-control expansion, not a direct data-read primitive; the high confidentiality rating depends on a follow-on attacker reaching the newly-exposed gRPC endpoint. Net: a real hardening issue for anyone running x-ui with multiple/low-trust panel users, but low real-world exploitation pressure given the authentication requirement and near-zero EPSS. |
| Exploit ScenarioDerived | A low-privileged but authenticated x-ui panel user edits the xray configuration template through the settings interface and triggers a panel restart. On regeneration, the xray management gRPC service - normally bound to loopback only - comes up listening on a non-loopback address, exposing the management control plane to other hosts on the network. A public analysis writeup exists (TraceLoom), but no confirmed weaponized exploit code was identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Authenticated x-ui panel users (including low-privilege ones) can broaden the network exposure of the panel's xray management gRPC listener in version 0.3.2 by editing the xray configuration template in the settings interface and then triggering a panel restart, which regenerates that listener bound to a non-loopback address instead of its intended loopback-only binding. The flaw is an improper access control issue (CWE-284) that lets any panel account change a network-exposure boundary it should not control; practical impact depends on a second party being able to reach the newly exposed gRPC endpoint, and exploitation requires valid panel credentials plus the ability to restart the panel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per independent assessment). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is very low at 0.15% (5th percentile), so the risk signals are mixed and lean toward moderate-but-not-urgent priority.
RemediationAI
No vendor-released patch version is identified in the available data; the only upstream pointer is the project repository (https://github.com/vaxilu/x-ui), so the first step is to check that repository and the NVD/EUVD records (https://nvd.nist.gov/vuln/detail/CVE-2026-79316, EUVD-2026-84205) for a fixed release before upgrading, and to treat any code change as unverified until a tagged version is confirmed. Until a fix is available, the highest-value compensating control is to stop the exposure at the network layer: keep the panel itself reachable only from a trusted management network or via a localhost-only reverse proxy with an IP allowlist, and add host firewall rules that drop inbound traffic to the panel's xray management gRPC port on non-loopback interfaces - with the trade-off that any legitimate remote administration of the proxy engine will break and will need to be tunnelled over SSH or a VPN. Reduce the attack surface inside the application by removing or disabling panel accounts that do not need settings access, restricting who may trigger a panel restart, and monitoring or file-integrity-checking the stored xray configuration template so that unexpected listener-binding changes are detected and reverted (this is detective, not preventive, so it requires alerting to be useful). Restarting the panel frequently to re-assert settings does not help, since the regeneration path is exactly what is abused; only upgrading to a version with an authorization check, or blocking external reachability of the gRPC listener, actually removes the weakness.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
x-ui is a web-based control panel used to manage Xray/V2Ray proxy configurations; internally it maintains manager access to the Xray core through a management gRPC service that is, by design, bound to loopback so that only local processes can administer the proxy engine. The vulnerability class is CWE-284 (Improper Access Control): the settings interface that renders and saves the xray configuration template does not restrict which panel roles may alter listener/binding parameters, and the restart routine regenerates the management service from that template, so a low-privilege authenticated panel user can move the gRPC listener onto a non-loopback interface. This is an authorization/role-boundary failure rather than a memory-safety or injection flaw, meaning the underlying technology (Go-based panel plus gRPC management channel) works as designed, but the permission model fails to protect a security-relevant configuration surface. The supplied CPE string (cpe:2.3:a:n/a:n/a) and EUVD affected-version data ("n/a n/a") provide no exact product/version enumeration, so version impact should be treated as x-ui 0.3.2 based on the description and the upstream project reference (https://github.com/vaxilu/x-ui).
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Authenticated low-priv panel user (PR:L) over network; direct effect is exposing the management gRPC surface, so impacts are low rather than C:H - high confidentiality only materializes via a follow-on attacker.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.
Executive ViewAI
x-ui version 0.3.2 contains a high-severity access control weakness that lets any authenticated panel account, including low-privilege users, alter the panel's xray management gRPC listener so it binds to a non-loopback address rather than the intended loopback-only interface. Because reaching that endpoint requires valid credentials plus a panel restart, and no public exploit or confirmed active exploitation exists and EPSS is very low, near-term likelihood is limited, but any organization relying on x-ui to manage proxy or VPN infrastructure could see an internal management interface exposed to other network parties, with follow-on confidentiality, integrity, and availability impact to the managed service. No vendor-released patch has been identified at time of analysis, so leadership should treat this as a configuration and access-governance risk requiring interim controls rather than an urgent emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the x-ui panel and its xray management gRPC listener to trusted administrative networks or localhost only; verify and enforce loopback-only binding; minimize and audit panel accounts, remove unnecessary low-privilege users, rotate credentials, and enforce multi-factor authentication; restrict the ability to edit the xray configuration template to a small trusted administrator group; monitor and alert on configuration-template changes, panel restarts, and any listener binding to a non-loopback address; network-segment the x-ui host; track the vendor for a fixed release and upgrade or migrate as soon as one is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB