Nginx UI: Step-up authentication bypass in MCP configuration tools
Summary
Nginx UI, a web interface for managing the Nginx web server, does not enforce the OTP secure-session check on the MCP routes /mcp and /mcp_message. An authenticated user with OTP enabled and a normal JWT, but without a valid secure session, can add or modify Nginx configuration and trigger a reload. The attacker needs valid credentials, so the risk is mainly for stolen accounts, phishing or malicious insiders, and for instances exposed to the internet.
Affected
- 0xJacky Nginx UI versions before 2.4.1
Fixed in
- Upgrade to Nginx UI 2.4.1 or later (vendor fix).
- Unknown: whether the v2.4.1 tag contains fix commit 23d1934; the release page shows a different short hash (0540f3e). Verify before relying on the tag.
- A later stable release is recommended; v2.4.2 and later are listed in public sources, but their fix scope for this CVE is not verified.
Workaround
- No vendor workaround found.
- Restrict access to the Nginx UI interface to management networks or VPN.
- Block or restrict /mcp and /mcp_message at a reverse proxy (analyst suggestion, not from the vendor).
- Disable MCP if it is not used.
Exploitation
- CISA SSVC assessment: Exploitation: poc, Automatable: no, Technical Impact: partial.
- No evidence of exploitation in the wild found in the sources reviewed.
- Not listed in CISA KEV according to one aggregator; not checked directly.
- EPSS 0.00347 (low).
Our recommendation
- Update Nginx UI to 2.4.1 or, preferably, the latest stable release.
- Confirm that /mcp and /mcp_message are not reachable from the internet.
- Restrict admin interface access to internal networks or MFA-protected VPN.
- Review accounts with OTP enabled and recent configuration changes.
- Check the managed Nginx configuration directory for unexpected files or changes.
- Monitor logs for requests to /mcp and /mcp_message from unknown sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vc32-4gwf-77xp github.com
- Fix commit 23d1934 github.com
- Release v2.4.1 github.com
- OSV entry CVE-2026-84360 osv.dev
- Go vulnerability GO-2026-6799 pkg.go.dev
- GitLab advisory database entry for CVE-2026-84360 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:56.
Original description (NVD)
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.