CVE-2026-84318

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.

• CWE-693

• https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m

Published

Oct 12, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84312Nginx UI is a web user interface for the Nginx web server. P…7.1
• CVE-2026-84313Nginx UI is a web user interface for the Nginx web server. P…8.8
• CVE-2026-84314Nginx UI is a web user interface for the Nginx web server. P…8.7
• CVE-2026-84315Nginx UI is a web user interface for the Nginx web server. P…8.3
• CVE-2026-84316Nginx UI is a web user interface for the Nginx web server. P…8.8
• CVE-2026-84317Nginx UI is a web user interface for the Nginx web server. P…8.8
• CVE-2026-84319Nginx UI is a web user interface for the Nginx web server. P…8.3
• CVE-2026-8432Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
• CVE-2026-84320Nginx UI is a web user interface for the Nginx web server. P…6.3
• CVE-2026-84321Nginx UI is a web user interface for the Nginx web server. P…5.4
• CVE-2026-84323Missing authorization in FileSystem in Google Chrome prior t…5.3
• CVE-2026-84324Use after free in Proxy in Google Chrome prior to 152.0.7977…9