CVE-2026-84318

Received Received - Intake

Remote Code Execution in Nginx UI via Config Injection

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84318

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	>= 2.0.0-rc.6, < 2.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Nginx UI versions 2.0.0-rc.6 to 2.4.0 have a flaw where the MCP tool nginx_config_add writes nginx config files to disk and reloads nginx without validating the config. This allows bypassing security restrictions. The REST API correctly validates configs but the MCP tool does not.

Detection Guidance

Check the version of nginx-ui installed on your system. If it is between 2.0.0-rc.6 and 2.4.0, the system is vulnerable. Run: nginx-ui --version or check the package manager for installed versions.

Impact Analysis

An authenticated attacker could exploit this to write malicious nginx config files containing dangerous directives like perl, js_import, or load_module. If nginx has Perl, njs, or Lua modules loaded, this leads to remote code execution. The attacker needs authentication but can then fully compromise the server.

Compliance Impact

This vulnerability could lead to unauthorized code execution on the server, potentially exposing sensitive data. This may violate compliance requirements for data protection and security controls in standards like GDPR and HIPAA, depending on the server's role and data processed.

Mitigation Strategies

Upgrade nginx-ui to version 2.4.1 or later immediately. If upgrading is not possible, restrict access to the REST API and MCP tool to trusted users only and monitor for suspicious configuration changes.

Hi! I’m here to help you understand CVE-2026-84318. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70