CVE-2026-84319 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale...

CVE-2026-84319

The Nginx UI web interface for the Nginx web server is vulnerable to a protection mechanism failure in versions prior to 2.4.1 . While the regular HTTP configuration API correctly rejects restricted directives like load_module, js_import, and js_content, the MCP configuration interface fails to d...

CVE-2026-84318

Nginx UI versions from 2.0.0-rc.6 until 2.4.1 are vulnerable to an authenticated security bypass. The MCP tool nginx_config_add writes configuration files to disk and triggers a reload without invoking config.ValidateConfigFile. This differs from the REST API, which correctly rejects dangerous di...