https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T03:36:52.534302+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-84360 fkie_cve-2026-84360 2026-10-20T03:36:52.535752+00:00

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.

 https://db.gcve.eu/vuln/ghsa-vc32-4gwf-77xp GHSA-vc32-4gwf-77xp — Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools 2026-10-20T03:36:52.535814+00:00

Affected: Go: github.com/0xJacky/Nginx-UI

### Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through `/mcp` and `/mcp_message` using only ordinary authentication.

### Details The HTTP configuration mutation surface is explicitly grouped behind `middleware.RequireSecureSession()`. By contrast, the MCP endpoints are exposed with only `middleware.AuthRequired()`. The MCP server exposes configuration mutation tools including `nginx_config_add` and `nginx_config_modify`, so OTP-enabled users gain an alternate path around the intended step-up requirement.

Relevant code paths: - [api/config/router.go](/home/kali/Desktop/bounty/nginx-ui/api/config/router.go:14) - [internal/middleware/secure_session.go](/home/kali/Desktop/bounty/nginx-ui/internal/middleware/secure_session.go:52) - [mcp/router.go](/home/kali/Desktop/bounty/nginx-ui/mcp/router.go:9) - [mcp/config/config_add.go](/home/kali/Desktop/bounty/nginx-ui/mcp/config/config_add.go:34) - [mcp/config/config_modify.go](/home/kali/Desktop/bounty/nginx-ui/mcp/config/config_modify.go:55)

This is a security-control bypass rather than a missing feature. The product already established that OTP-enabled users should complete a secure session before high-impact configuration mutations are accepted on the HTTP path.

### PoC I verified this locally in an isolated environment with a temporary end-to-end harness that exercised the real `/mcp` and `/mcp_message` ro…