CVE-2026-84360

Received Received - Intake

Cross-Site Request Forgery in Nginx UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84360

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	< 2.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

Nginx UI before version 2.4.1 has a security flaw where certain HTTP configuration mutation routes like /mcp and /mcp_message only require ordinary authentication instead of requiring RequireSecureSession. This allows an OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID to create or modify Nginx configurations and trigger reload behavior through MCP, bypassing intended security controls.

Detection Guidance

Check if your Nginx UI version is below 2.4.1. Inspect network traffic for unauthorized access to /mcp or /mcp_message endpoints. Look for unexpected Nginx configuration changes or reloads.

Impact Analysis

This vulnerability could allow unauthorized users to modify Nginx configurations, potentially leading to server misconfigurations, service disruptions, or unauthorized access to sensitive data. Attackers could exploit this to change server settings, redirect traffic, or introduce malicious configurations.

Compliance Impact

This vulnerability allows unauthorized users to modify Nginx configurations via MCP endpoints, potentially exposing sensitive data or disrupting services. For GDPR, this could lead to unauthorized data processing or breaches. For HIPAA, it may compromise protected health information integrity or availability.

Mitigation Strategies

Upgrade Nginx UI to version 2.4.1 or later. Ensure RequireSecureSession is enforced for all sensitive routes. Review and audit Nginx configuration changes for unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-84360. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70