Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...

GHSA-CF23-7QXJ-XMHR Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...

GHSA-76PM-MQ2Q-9GCR Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...

CVE-2026-91184

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic "";. A namespaced authenticated attacker that configures...

CVE-2026-91184

NGINX Gateway Fabric (versions 2.4.0 - 2.7.2 ) is vulnerable to a control plane issue where it renders the spec.basic.realm and spec.jwt.realm fields of a namespaced AuthenticationFilter CRD verbatim and unvalidated into the shared data-plane nginx.conf . A namespaced authenticated attacker can c...

K000162609: NGINX Gateway Fabric vulnerability CVE-2026-91184

Security Advisory Description NGINX Gateway Fabric has a vulnerability when it renders spec.basic.realm and spec.jwt.realm of a namespaced AuthenticationFilter Custom Resource Definition CRD verbatim, unescaped and unvalidated, into the shared data plane nginx.conf as authbasic "";. A namespaced...

PT-2026-114333

🚨 CVE-2026-91184 Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth basic "";. A namespaced authenticated attacke...

CVE-2026-84316

The Nginx UI web user interface (versions prior to 2.4.1 ) is vulnerable to a validation bypass in the config.ValidateConfigDirectives function. The software incorrectly splits configuration by newline and only validates the first token, allowing an authenticated caller to append restricted direc...

CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84317

Prior to version 2.4.1 , Nginx UI (a web user interface for the Nginx web server) contains a vulnerability where the mcp/config/config_add.go path (MCP tool nginx_config_add) fails to call the internal/config/validation.go security control. While other config-write paths block dangerous directive...

CVE-2026-84317 Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write...

CVE-2026-84317 Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write...

ingressnightmare-detection-poc

IngressNightmare Detection Tool Overview This tool provides a non-intrusive detection capability for the IngressNightmare vulnerability chain CVE-2025-1974 affecting Ingress NGINX Controller. It specifically leverages the auth-url annotation injection vector CVE-2025-24514 to verify the presence ...

CVE-2026-87678

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

EUVD-2026-94672

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

DEBIAN-CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...

UBUNTU-CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...

CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...