CVE-2026-84316

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.

• CWE-20
• CWE-184

• https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cf23-7qxj-xmhr
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cf23-7qxj-xmhr

Published

Oct 12, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84310pypdf is a free and open-source pure-python PDF library. Pri…3.3
• CVE-2026-84311pypdf is a free and open-source pure-python PDF library. Pri…3.3
• CVE-2026-84312Nginx UI is a web user interface for the Nginx web server. P…7.1
• CVE-2026-84313Nginx UI is a web user interface for the Nginx web server. P…8.8
• CVE-2026-84314Nginx UI is a web user interface for the Nginx web server. P…8.7
• CVE-2026-84315Nginx UI is a web user interface for the Nginx web server. P…8.3
• CVE-2026-84317Nginx UI is a web user interface for the Nginx web server. P…8.8
• CVE-2026-84318Nginx UI is a web user interface for the Nginx web server. F…8.8
• CVE-2026-84319Nginx UI is a web user interface for the Nginx web server. P…8.3
• CVE-2026-8432Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
• CVE-2026-84320Nginx UI is a web user interface for the Nginx web server. P…6.3
• CVE-2026-84321Nginx UI is a web user interface for the Nginx web server. P…5.4