Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-84319— Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Quick assessment

Affected
0xJacky nginx-ui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nginx UI 是 Nginx Web 服务器的一个 Web 用户界面。在 2.4.1 版本之前，常规的 HTTP 配置 API 会拒绝某些受限的 Nginx 指令，例如 load_module、js_import 和 js_content。然而，MCP 配置接口允许经过二次认证的用户编写并应用等效的受限配置内容。这使得攻击者能够加载 ngx_http_js_module.so 模块，引入由攻击者控制的 JavaScript 代码，重新加载 Nginx，并在 Nginx 的工作进程中执行 NJS 脚本。该问题已在

CVSS 8.3 · High EPSS 0.28% · P19

Affected Version Matrix 1

VendorProduct Version RangeStatus
0xJacky nginx-ui < 2.4.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84319

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Source: CVE Program / CVE List V5
Vulnerability Description
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
0xJacky nginx-ui < 2.4.1 -

II. Public POCs for CVE-2026-84319

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84319

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-84319 (1)

Same Patch Batch · 0xJacky · 2026-10-12 · 11 CVEs total

CVE-2026-84318 8.8 HIGH Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
CVE-2026-84313 8.8 HIGH Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent acco
CVE-2026-84316 8.8 HIGH Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line
CVE-2026-84317 8.8 HIGH Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx dir
CVE-2026-84314 8.7 HIGH Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
CVE-2026-84315 8.3 HIGH Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
CVE-2026-84360 8.1 HIGH Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
CVE-2026-84312 7.1 HIGH Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
CVE-2026-84320 6.3 MEDIUM Nginx UI: Auto backup name allows path traversal outside validated storage path
CVE-2026-84321 5.4 MEDIUM Nginx UI: Standalone short tokens survive administrative revocation in cache and authentic

IV. Related Vulnerabilities

Same product: nginx-ui
Same vendor: 0xJacky
Same weakness: CWE-693

V. Comments for CVE-2026-84319

No comments yet

Leave a comment