CVE-2026-84317

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1.

• CWE-20
• CWE-693

• https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr

Published

Oct 12, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84311pypdf is a free and open-source pure-python PDF library. Pri…3.3
• CVE-2026-84312Nginx UI is a web user interface for the Nginx web server. P…7.1
• CVE-2026-84313Nginx UI is a web user interface for the Nginx web server. P…8.8
• CVE-2026-84314Nginx UI is a web user interface for the Nginx web server. P…8.7
• CVE-2026-84315Nginx UI is a web user interface for the Nginx web server. P…8.3
• CVE-2026-84316Nginx UI is a web user interface for the Nginx web server. P…8.8
• CVE-2026-84318Nginx UI is a web user interface for the Nginx web server. F…8.8
• CVE-2026-84319Nginx UI is a web user interface for the Nginx web server. P…8.3
• CVE-2026-8432Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
• CVE-2026-84320Nginx UI is a web user interface for the Nginx web server. P…6.3
• CVE-2026-84321Nginx UI is a web user interface for the Nginx web server. P…5.4
• CVE-2026-84323Missing authorization in FileSystem in Google Chrome prior t…5.3