IT SBIT Services
Schneeberger
DEEN
CVE tracker

Nginx UI: Directive validation bypass in MCP config add leads to RCE

CVE-2026-84318High 8.8

← All vulnerabilities

Summary

Nginx UI, a web interface for managing nginx, does not validate nginx configuration files written through the MCP tool nginx_config_add. The REST API performs this validation and rejects dangerous directives, but the MCP path does not, so an authenticated user can write blocked directives such as perl, js_import, load_module or user root. If nginx has the Perl, njs or Lua module loaded, this can lead to remote code execution on the server.

Affected

  • Nginx UI from 2.0.0-rc.6 up to, but not including, 2.4.1
  • Exploitation requires a valid authenticated session
  • Code execution requires the nginx Perl, njs or Lua module to be loaded

Fixed in

  • Fixed in Nginx UI 2.4.1
  • Fixing commit: 23d1934099b05b2a01589b48129dc3d3159d91c2
  • Newer releases (e.g. 2.5.x) extend validation to the MCP add tool; the exact fix for this CVE in 2.5.x is unverified

Workaround

  • No vendor workaround known.
  • Restrict or disable MCP access and do not expose the MCP endpoint to the internet.
  • Limit which accounts hold admin or MCP-capable tokens.
  • Audit conf.d and included files for load_module, js_import, perl or user root entries added outside the UI.

Exploitation

  • CISA SSVC: exploitation status PoC, not automatable, total technical impact.
  • No evidence of in-the-wild exploitation found; not listed in KEV according to one aggregator.
  • A related advisory (GHSA-5r62-gj48-897x) describes a lab-tested NJS execution path via the MCP tool on a 2.x development build; not verified.
  • EPSS at the time of the cached records: 0.00617.

Our recommendation

  • Inventory all Nginx UI instances and confirm the version is at least 2.4.1; preferably run the latest stable release.
  • Confirm the MCP endpoint is not reachable from the internet.
  • Check whether nginx includes the Perl, njs or Lua modules (nginx -V).
  • Review nginx configuration files for unexpected dangerous directives.
  • Patch together with CVE-2026-84317, which affects the same code path.
  • Check for the older advisory GHSA-h6c2-x2m2-mwhf (unauthenticated MCP endpoint) if any instance is exposed.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:22.

Original description (NVD)

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed