CVE-2026-84319

The Nginx UI web interface for the Nginx web server is vulnerable to a protection mechanism failure in versions prior to 2.4.1 . While the regular HTTP configuration API correctly rejects restricted directives like load_module, js_import, and js_content, the MCP configuration interface fails to d...

CVE-2026-84319 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale...

CVE-2026-84318 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-84318

Nginx UI versions from 2.0.0-rc.6 until 2.4.1 are vulnerable to an authenticated security bypass. The MCP tool nginx_config_add writes configuration files to disk and triggers a reload without invoking config.ValidateConfigFile. This differs from the REST API, which correctly rejects dangerous di...

SUSE-SU-2026:21858-1 Security update for python-mistune

This update for python-mistune fixes the following issues - CVE-2026-33079: ReDoS in LINKTITLERE can lead to denial of service via a crafted Markdown bsc1264347. - CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of service bsc1264752. ...