CVE-2026-84360

🗓️ 12 Oct 2026 21:08:04Reported by MendType

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and ngi...

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2026-84360	12 Oct 202622:01	–	circl
CVE	CVE-2026-84360	12 Oct 202621:08	–	cve
Cvelist	CVE-2026-84360 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools	12 Oct 202621:08	–	cvelist
EUVD	EUVD-2026-97907	12 Oct 202621:08	–	euvd
NVD	CVE-2026-84360	12 Oct 202621:17	–	nvd
Positive Technologies	PT-2026-110977	12 Oct 202600:00	–	ptsecurity

Vulners

Node

nginxui nginx_uiRange2.4.0–2.4.1

nginxui nginx_uiRange1.9.10-0.20260204031510-495cb4e71e9c–1.9.10-0.20260703134738-0540f3ecf782

Source	Link
github	www.github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
github	www.github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
github	www.github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp

13 Oct 2026 05:33Current

5.8Medium risk

Vulners AI Score5.8

CVSS 47.2

CVSS 3.18.1

CWE-288