CVE-2026-84315
Last modified
CVE-2026-84315 is a high-severity vulnerability rated 8.3/10 on the CVSS scale. Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| 0xJacky | nginx-ui | < 2.4.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-84315?
How severe is CVE-2026-84315?
How do I fix CVE-2026-84315?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8431An administrative user with access to configure webhooks can…7.2
- CVE-2026-84310pypdf is a free and open-source pure-python PDF library. Pri…3.3
- CVE-2026-84311pypdf is a free and open-source pure-python PDF library. Pri…3.3
- CVE-2026-84312Nginx UI is a web user interface for the Nginx web server. P…7.1
- CVE-2026-84313Nginx UI is a web user interface for the Nginx web server. P…8.8
- CVE-2026-84314Nginx UI is a web user interface for the Nginx web server. P…8.7
- CVE-2026-84316Nginx UI is a web user interface for the Nginx web server. P…8.8
- CVE-2026-84317Nginx UI is a web user interface for the Nginx web server. P…8.8
- CVE-2026-84318Nginx UI is a web user interface for the Nginx web server. F…8.8
- CVE-2026-84319Nginx UI is a web user interface for the Nginx web server. P…8.3
- CVE-2026-8432Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
- CVE-2026-84320Nginx UI is a web user interface for the Nginx web server. P…6.3
Are you affected by CVE-2026-84315?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST