Vulnerability · Published Oct 12, 2026 · Assigned by GitHub_M
CVE-2026-84318Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
High 8.8
In plain English
A high-severity security flaw in nginx-ui from 0xJacky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/0xJacky/Nginx-UI | 1.9.10-0.20260703131214-23d1934099b0 | GHSA-9jww-cxg5-rj9m |
| Go | github.com/0xJacky/Nginx-UI | 1.9.10-0.20260703131214-23d1934099b0 | GO-2026-6781 |
Affected products (as reported)
Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m x_refsource_CONFIRM
- https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2 x_refsource_MISC
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1 x_refsource_MISC