36 matches found
GO-2026-6779 Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
Nginx UI: MCP nginxconfigadd skips config directive validation → authenticated nginx directive injection RCE on the official image in github.com/0xJacky/Nginx-UI...
Security Control Bypass
github.com/0xjacky/nginx-ui is vulnerable to security control bypass. The vulnerability is due to the MCP tool nginxconfigadd failing to validate configuration files before writing them to disk and reloading Nginx, which allows an authenticated attacker to bypass security restrictions by injectin...
Remote Code Execution (RCE)
github.com/0xjacky/nginx-ui is vulnerable to remote code execution RCE. The vulnerability is due to the nginxconfigadd MCP tool bypassing security validation, which allows an authenticated attacker to inject dangerous Nginx directives and execute arbitrary code when the required modules are...
Nginx MCP Config Add Data Compromise
The vulnerability of the nginxconfigadd function in the MCP component of the Nginx UI server’s user interface relates to a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker to compromise the integrity and accessibility of the protected information...
Nginx UI Code Execution
The vulnerability of the nginxconfigadd function in the Nginx UI server’s user interface is related to a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
Nginx UI MCP Component Data Compromise
The vulnerabilities of the nginxconfigadd and nginxconfigmodify functions of the MCP component of the Nginx UI server involve bypassing authentication procedures by using an alternative path or channel. Exploiting these vulnerabilities allows a malicious actor to compromise the integrity and...
EUVD-2026-97907
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools...
GHSA-VC32-4GWF-77XP Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...
GHSA-9JWW-CXG5-RJ9M Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Summary The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that function and correctly rejects dangerous directives. An authenticated attacker c...
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Summary The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that function and correctly rejects dangerous directives. An authenticated attacker c...
EUVD-2026-97908
Nginx UI: MCP nginxconfigadd Bypasses Directive Validation — Authenticated RCE...
GHSA-76PM-MQ2Q-9GCR Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...
GHSA-5R62-GJ48-897X Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Summary The regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the...
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Summary The regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the...
CVE-2026-84317
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write...
CVE-2026-84318
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...
CVE-2026-84360
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...
CVE-2026-84360
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...