CVE-2026-84319

🗓️ 12 Oct 2026 21:03:36Reported by MendType

mend🔗 www.mend.io👁 12 Views

Authenticated user can use MCP configuration interface to execute NJS in Nginx.

Reporter	Title	Published	Views	Family All 15
BDU FSTEC	Nginx MCP Config Add Data Compromise	16 Oct 202600:00	–	bdu_fstec
Circl	CVE-2026-84319	12 Oct 202622:00	–	circl
CVE	CVE-2026-84319	12 Oct 202621:03	–	cve
Cvelist	CVE-2026-84319 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context	12 Oct 202621:03	–	cvelist
EUVD	EUVD-2026-97905	15 Oct 202620:10	–	euvd
Github Security Blog	Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context	15 Oct 202620:10	–	github
NVD	CVE-2026-84319	12 Oct 202621:17	–	nvd
osv_cve	CVE-2026-84319 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context	12 Oct 202621:03	–	osv_cve
osv_ghsa	GHSA-5R62-GJ48-897X Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context	15 Oct 202620:10	–	osv_ghsa
osv_go	GO-2026-6774 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI	19 Oct 202621:08	–	osv_go

Vulners

Node

nginxui nginx_uiRange2.4.0–2.4.1

nginxui nginx_uiRange1.9.10-0.20260613100722-6053fa0d5488–1.9.10-0.20260703134738-0540f3ecf782

Source	Link
github	www.github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
github	www.github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
github	www.github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x

13 Oct 2026 05:31Current

7.7High risk

Vulners AI Score7.7

CVSS 47.2

CVSS 3.18.3

EPSS0.0028