Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI
{
"review_status": "UNREVIEWED",
"url": "https://pkg.go.dev/vuln/GO-2026-6706"
}