CVE-2026-84317 Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write...

CVE-2026-78545

The Okta Access Gateway is vulnerable to improper input sanitization within the application label field . Because the software fails to sanitize this field before including it in the generated nginx configuration file , an unsanitized value can be interpolated into an nginx server block directive...