Nginx UI: Authenticated config directive validation bypass allows code execution
Summary
Nginx UI, a web interface for managing Nginx, checks only the first directive on each line of the nginx configuration, but Nginx also accepts several semicolon-separated directives per line. An authenticated user can hide restricted directives such as load_module, js_import, perl, user root, or an unrestricted include after a harmless directive on the same line. This bypasses validation on the REST, configuration, site and stream write paths, and when an executable module is available, the injected configuration can run code in the Nginx worker context.
Affected
- Nginx UI (0xJacky/nginx-ui) before 2.4.1
- Go module github.com/0xJacky/nginx-ui: pseudo-version range below 1.9.10-0.20260703131214-23d1934099b0
Fixed in
- Nginx UI 2.4.1 (fix commit 23d1934099b05b2a01589b48129dc3d3159d91c2)
Workaround
Unknown. The vendor advisory points to the fix, and no documented interim measure was found.
Exploitation
- CISA SSVC lists exploitation as PoC, not automatable, with total technical impact.
- Not listed in CISA KEV in the sources checked.
- No in-the-wild exploitation is known. Sources differ on public exploit availability.
Our recommendation
- Update Nginx UI to version 2.4.1 or later without delay.
- Restrict access to the Nginx UI interface to administration networks or VPN, and do not expose it to the internet.
- Limit accounts with write access and enforce strong passwords and two-factor authentication.
- Review recent configuration changes for multiple directives on one line.
- Check whether the Nginx build includes the njs or perl modules, and monitor logs for unexpected configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub security advisory GHSA-cf23-7qxj-xmhr github.com
- Nginx UI release v2.4.1 github.com
- Fix commit 23d1934 github.com
- OSV record CVE-2026-84316 osv.dev
- OSV record GO-2026-6782 osv.dev
- VulDB entry 417245 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:21.
Original description (NVD)
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.