CVE-2026-79316: x-ui Panel Privilege Escalation Vulnerability

CVE-2026-79316 Overview

CVE-2026-79316 is an improper access control vulnerability [CWE-284] in x-ui version 0.3.2, an open-source panel for managing xray-core deployments. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart. This action regenerates the xray management gRPC service and rebinds it from the loopback interface to non-loopback addresses. The change expands the reachable surface of the management interface beyond its intended local-only boundary, exposing sensitive control plane functionality to the network.

Critical Impact
Low-privileged authenticated users can expose the xray management gRPC service to remote networks, enabling unauthorized access to proxy configuration and control functions.

Affected Products

x-ui version 0.3.2
xray-core management gRPC service configured via x-ui
Deployments relying on default loopback-only binding for the management interface

Discovery Timeline

2026-09-21 - CVE-2026-79316 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-79316

Vulnerability Analysis

The vulnerability resides in the settings interface of x-ui 0.3.2. The panel allows authenticated users to edit the xray configuration template directly. This template controls how the xray management gRPC service is generated on panel restart. The application does not validate or restrict which network interfaces the resulting gRPC listener binds to. As a result, a user with panel access can alter the template to bind the management service to any address, including 0.0.0.0 or a public interface.

By default, the management gRPC service listens on the loopback interface only. This design assumes the management plane remains inaccessible from the network. The vulnerability breaks that assumption by giving low-privileged users the ability to rewrite the binding through a routine configuration workflow. Successful exploitation moves the management interface outside the trust boundary defined by the deployment.

Root Cause

The root cause is missing access control and input validation on the xray configuration template editor. The panel treats template modifications as trusted administrative input without enforcing constraints on sensitive fields such as listener addresses. Combined with a restart trigger available to the same user, the flaw allows an authenticated actor to change the network exposure of a service that should remain local.

Attack Vector

Exploitation requires network access to the x-ui panel and valid authenticated credentials. The attacker logs in, edits the xray configuration template through the settings interface, and triggers a panel restart. The regenerated gRPC service binds to a non-loopback address specified in the modified template. From there, the attacker or any third party with network reachability can interact with the management interface. See the technical write-up on GitHub and the x-ui repository for context. No public proof-of-concept exploit code is referenced in the CVE record.

Detection Methods for CVE-2026-79316

Indicators of Compromise

Unexpected changes to the xray configuration template stored by x-ui, particularly modifications to listener address fields.
xray management gRPC service listening on non-loopback addresses such as 0.0.0.0 or a public IP after a panel restart.
Panel restart events initiated by non-administrative user accounts.

Detection Strategies

Compare the running xray configuration against a known-good baseline template and flag deviations in bind addresses.
Audit x-ui panel activity logs for template edits followed by service restarts within a short interval.
Run periodic port scans against x-ui hosts to identify gRPC management ports exposed outside the loopback interface.

Monitoring Recommendations

Monitor inbound connections to the xray management gRPC port from non-local sources and alert on any successful session.
Track authentication events on the x-ui panel and correlate low-privileged user activity with configuration or restart actions.
Ingest x-ui and host network telemetry into a centralized analytics platform for correlation across configuration and network layers.

How to Mitigate CVE-2026-79316

Immediate Actions Required

Restrict network access to the x-ui panel using firewall rules or a VPN so only trusted administrators can reach the settings interface.
Review all panel user accounts and remove or downgrade accounts that do not require configuration privileges.
Rotate credentials for all x-ui panel users and enforce strong authentication.
Inspect the current xray configuration template and confirm the management gRPC service is bound to the loopback interface only.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-79316 at the time of publication. Monitor the x-ui GitHub repository for updates and apply fixes as soon as they are released.

Workarounds

Place the x-ui panel behind a reverse proxy that enforces additional authentication and IP allowlisting.
Use host-based firewall rules to block external access to the xray management gRPC port regardless of its bind address.
Deploy x-ui inside an isolated network segment or container namespace so a rebound management service remains unreachable from untrusted networks.
Implement file integrity monitoring on the xray configuration template to detect unauthorized edits.

bash

# Example host firewall rules to restrict management gRPC exposure
# Replace <mgmt_port> with the port used by the xray management service
iptables -A INPUT -i lo -p tcp --dport <mgmt_port> -j ACCEPT
iptables -A INPUT -p tcp --dport <mgmt_port> -j DROP