CVE-2026-79316

Summary

An authenticated user can modify xray configuration templates to make the management service accessible from non-loopback addresses, expanding the attack surface beyond its intended local-only boundary. This allows attackers to potentially access the xray management interface from external networks.

Exploitability

Exploitation requires an authenticated panel user account with access to settings, which is typically available to users with minimal privileges, making it moderately easy to exploit.

Blast radius

The vulnerability could allow unauthorized external access to the xray management service, potentially enabling attackers to manipulate the underlying proxy configuration and compromise the entire proxy infrastructure.

Detection

Monitor for unexpected changes to xray configuration files in the x-ui directory, particularly those related to gRPC service binding settings, and watch for processes binding to non-loopback addresses like 0.0.0.0 or specific external IPs instead of 127.0.0.1.

Prioritized remediation

Upgrade to x-ui version 0.3.3 or later to address this access control flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.