Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...

GHSA-2GC7-J998-5XX6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...

EUVD-2026-97862

Nginx UI: Account Takeover via Missing RequireSecureSession on User Management Endpoint...

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...

EUVD-2026-97865

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover...

GHSA-GFRC-G87H-7H5W Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...

EUVD-2026-97908

Nginx UI: MCP nginxconfigadd Bypasses Directive Validation — Authenticated RCE...

Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Summary The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that function and correctly rejects dangerous directives. An authenticated attacker c...

GHSA-9JWW-CXG5-RJ9M Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Summary The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that function and correctly rejects dangerous directives. An authenticated attacker c...

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...

EUVD-2026-97895

Nginx UI: MCP nginxconfigadd skips config directive validation → authenticated nginx directive injection RCE on the official image...

GHSA-76PM-MQ2Q-9GCR Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...

Nginx UI: Auto backup name allows path traversal outside validated storage path

Summary Nginx UI validates backuppath and storagepath against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can...

EUVD-2026-97860

Nginx UI: Auto backup name allows path traversal outside validated storage path...

GHSA-JRQ7-XRJX-PCFW Nginx UI: Auto backup name allows path traversal outside validated storage path

Summary Nginx UI validates backuppath and storagepath against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can...

EUVD-2026-97905

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context...

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Summary The regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the...

GHSA-5R62-GJ48-897X Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Summary The regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the...

HTB-Snapped-Writeup

HTB-Snapped-Writeup HTB Snapped — Hard Linux machine writeup. CVE-2026-27944 Nginx UI unauthenticated backup disclosure chained with CVE-2026-3888 snapd race condition LPE to achieve full system compromise. HTB: Snapped — Writeup Difficulty: Hard OS: Linux Ubuntu 24.04 Release Date: 23 Mar 2026...