ZeroDay Findings
Sign inSign up

Findings

CVE-2026-84319

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Published Oct 12, 2026 · updated Oct 15, 2026 · 0xJacky nginx-ui

## Summary The regular HTTP configuration API rejects restricted Nginx directives such as , , and . However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load , import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This is authenticated and is not OS command execution by itself. ## Affected component - - - MCP tool: - Nginx configuration validation ## Impact A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context. This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling. ## Minimal PoC ### Preconditions - Attacker has a secondary authenticated Nginx UI account. - MCP is enabled. - Nginx has NJS available: Observed in the lab: ### 1. HTTP API blocks the restricted config Request: Body: Observed result: ### 2. MCP writes the JavaScript file Open an MCP session and call with: ### 3. MCP writes the NJS-enabled nginx.conf Call again: ### 4. Verify NJS execution Inside the Nginx UI container: Observed response: This confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context. ## Expected behavior MCP configuration tools should enforce the same restricted directive validation as the HTTP API. ## Suggested fix Apply before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as: - - - - - -

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitHub Advisory Database

    Detected

    ## Summary The regular HTTP configuration API rejects restricted Nginx directives such as , , and . However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load , import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This is authent

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ## Summary The regular HTTP configuration API rejects restricted Nginx directives such as , , and . However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load , import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This is authent

Affected

  • Go github.com/0xJacky/Nginx-UI0 → 1.9.10-0.20260703131214-23d1934099b0
  • golang github.comversion unspecified
  • vendor 0xJacky nginx-uiversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-84319

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to writ

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-5r62-gj48-897x

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-84319

    The regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in t

    advisories.gitlab.com
  • OSV.devPackage advisoryGHSA-5r62-gj48-897x

    Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

    osv.dev

References