CVE-2026-79316 Details

A vulnerability in x-ui version 0.3.2 allows authenticated panel users to improperly access and modify the Xray configuration template via the settings interface. This change can trigger a panel restart, which inadvertently exposes the Xray management gRPC service to non-loopback addresses. As a result, the management interface, originally intended to be local-only, becomes accessible from a wider network, increasing the risk of unauthorized access to sensitive management functions.

As of the report date, no official patch has been released. To mitigate this vulnerability, manually override the management interface's binding address to loopback before applying configuration changes, or remove high-risk settings from user-editable templates and manage them server-side. If immediate code changes are not possible, restrict access to the management interface using firewall rules or container network policies, and monitor for unauthorized changes to the binding address in the configuration template.