ingressnightmare-detection-poc

IngressNightmare Detection Tool Overview This tool provides a non-intrusive detection capability for the IngressNightmare vulnerability chain CVE-2025-1974 affecting Ingress NGINX Controller. It specifically leverages the auth-url annotation injection vector CVE-2025-24514 to verify the presence ...

WordPress Yoast SEO Premium plugin < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE vulnerability

Author+ Arbitrary .htaccess Directive Injection to RCE vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Yoast SEO Premium versions 27.6.1...

BIT-NGINX-GATEWAY-FABRIC-2026-91184 NGINX Gateway Fabric vulnerability

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic "";. A namespaced authenticated attacker that configures...

GO-2026-6779 Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI

Nginx UI: MCP nginxconfigadd skips config directive validation → authenticated nginx directive injection RCE on the official image in github.com/0xJacky/Nginx-UI...

GO-2026-6782 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI

Nginx UI: nginx config directive denylist ValidateConfigFile is bypassable via same-line ";" separation → authenticated directive injection RCE on the official image in github.com/0xJacky/Nginx-UI...

PT-2026-118078

Nginx UI: nginx config directive denylist ValidateConfigFile is bypassable via same-line ";" separation → authenticated directive injection RCE on the official image in github.com/0xJacky/Nginx-UI...

PT-2026-118076

Nginx UI: MCP nginx config add skips config directive validation → authenticated nginx directive injection RCE on the official image in github.com/0xJacky/Nginx-UI...

Exploit for CVE-2026-103849

CVE-2026-103849 / BlockStrap validation lab !Static validat...

Magento Open Source 2.4.9-2026-sep Block Directive Injection

Magento Open Source version 2.4.9-2026-sep and earlier contains a template directive-injection vulnerability. This lab provides proof of concept A/B validation for an unauthenticated block-directive primitive and bounded file side effect, with a separately labeled synthetic fixed-command gadget...

GHSA-CF23-7QXJ-XMHR Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...

Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...

GHSA-76PM-MQ2Q-9GCR Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...

CVE-2026-91184

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic "";. A namespaced authenticated attacker that configures...

CVE-2026-91184

NGINX Gateway Fabric (versions 2.4.0 - 2.7.2 ) is vulnerable to a control plane issue where it renders the spec.basic.realm and spec.jwt.realm fields of a namespaced AuthenticationFilter CRD verbatim and unvalidated into the shared data-plane nginx.conf . A namespaced authenticated attacker can c...

K000162609: NGINX Gateway Fabric vulnerability CVE-2026-91184

Security Advisory Description NGINX Gateway Fabric has a vulnerability when it renders spec.basic.realm and spec.jwt.realm of a namespaced AuthenticationFilter Custom Resource Definition CRD verbatim, unescaped and unvalidated, into the shared data plane nginx.conf as authbasic "";. A namespaced...

PT-2026-114333

Name of the Vulnerable Software and Affected Versions NGINX Gateway Fabric affected versions not specified Description An issue exists when the software renders the spec.basic.realm and spec.jwt.realm fields of a namespaced AuthenticationFilter into the shared data-plane nginx.conf. Because these...

CVE-2026-91184: Improper Neutralization of Equivalent Special Elements

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic " ";. A namespaced authenticated attacker that configures...

CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...