https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 03:36:55 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-84360 <p>Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.</p> <p>Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-84360 https://db.gcve.eu/vuln/ghsa-vc32-4gwf-77xp <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>### Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through `/mcp` and `/mcp_message` using only ordinary authentication.</p> <p>### Details The HTTP configuration mutation surface is explicitly grouped behind `middleware.RequireSecureSession()`. By contrast, the MCP endpoints are exposed with only `middleware.AuthRequired()`. The MCP server exposes configuration mutation tools including `nginx_config_add` and `nginx_config_modify`, so OTP-enabled users gain an alternate path around the intended step-up requirement.</p> <p>Relevant code paths: - [api/config/router.go](/home/kali/Desktop/bounty/nginx-ui/api/config/router.go:14) - [internal/middleware/secure_session.go](/home/kali/Desktop/bounty/nginx-ui/internal/middleware/secure_session.go:52) - [mcp/router.go](/home/kali/Desktop/bounty/nginx-ui/mcp/router.go:9) - [mcp/config/config_add.go](/home/kali/Desktop/bounty/nginx-ui/mcp/config/config_add.go:34) - [mcp/config/config_modify.go](/home/kali/Desktop/bounty/nginx-ui/mcp/config/config_modify.go:55)</p> <p>This is a security-control bypass rather than a missing feature. The product already established that OTP-enabled users should complete a secure session before high-impact configuration mutations are accepted on the HTTP path.</p> <p>### PoC I verified this locally in an isolated environment with a temporary end-to-end harness that exercised the real `/mcp` and `/mcp_message` ro…</p> <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>### Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through `/mcp` and `/mcp_message` using only ordinary authentication.</p> <p>### Details The HTTP configuration mutation surface is explicitly grouped behind `middleware.RequireSecureSession()`. By contrast, the MCP endpoints are exposed with only `middleware.AuthRequired()`. The MCP server exposes configuration mutation tools including `nginx_config_add` and `nginx_config_modify`, so OTP-enabled users gain an alternate path around the intended step-up requirement.</p> <p>Relevant code paths: - [api/config/router.go](/home/kali/Desktop/bounty/nginx-ui/api/config/router.go:14) - [internal/middleware/secure_session.go](/home/kali/Desktop/bounty/nginx-ui/internal/middleware/secure_session.go:52) - [mcp/router.go](/home/kali/Desktop/bounty/nginx-ui/mcp/router.go:9) - [mcp/config/config_add.go](/home/kali/Desktop/bounty/nginx-ui/mcp/config/config_add.go:34) - [mcp/config/config_modify.go](/home/kali/Desktop/bounty/nginx-ui/mcp/config/config_modify.go:55)</p> <p>This is a security-control bypass rather than a missing feature. The product already established that OTP-enabled users should complete a secure session before high-impact configuration mutations are accepted on the HTTP path.</p> <p>### PoC I verified this locally in an isolated environment with a temporary end-to-end harness that exercised the real `/mcp` and `/mcp_message` ro…</p> https://db.gcve.eu/vuln/ghsa-vc32-4gwf-77xp