Skip to content
Heist/ feed
Back to feed
High

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Type: advisorySources: OSV

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-84319
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 06:14 UTC · Revision 1

Source evidence

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

core-osv · Original source

Published 12 Oct 2026, 21:03 UTC

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.

osv:CVE-2026-84319
Complete source record
{
  "id": "1a67454cf180a005829831589d00b41c9562a3996faa28eae0746d3eba29f78e",
  "url": "https://osv.dev/vulnerability/CVE-2026-84319",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context",
    "summary": "Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.",
    "evidence": "osv:CVE-2026-84319",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-84319",
      "aliases": [
        "CVE-2026-84319",
        "GHSA-5r62-gj48-897x",
        "GO-2026-6774"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/0xjacky/nginx-ui",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0540f3ecf7824e9adbe408f3166d151651ccf4dd"
                },
                {
                  "fixed": "23d1934099b05b2a01589b48129dc3d3159d91c2"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.4.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "23d1934099b05b2a01589b48129dc3d3159d91c2"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "0540f3ecf7824e9adbe408f3166d151651ccf4dd"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.4.1"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.4.0",
            "v2.3.11",
            "v2.3.10",
            "v2.3.9",
            "v2.3.8",
            "v2.3.7",
            "v2.3.6",
            "v2.3.5",
            "v2.3.4",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.1",
            "v2.2.0-patch.1",
            "v2.2.0",
            "v2.1.17",
            "v2.1.16",
            "v2.1.15",
            "v2.1.14",
            "v2.1.13",
            "v2.1.12",
            "v2.1.11",
            "v2.1.10",
            "v2.1.9",
            "v2.1.8",
            "v2.1.7",
            "v2.1.6",
            "v2.1.5",
            "v2.1.4-patch.1",
            "v2.1.4",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0-patch.1",
            "v2.1.0",
            "v2.1.0-rc.3",
            "v2.1.0-rc.2",
            "v2.1.0-rc.1",
            "v2.1.0-beta.1",
            "v2.0.2",
            "v2.0.1",
            "v2.0.0",
            "v2.0.0-rc.8-patch.1",
            "v2.0.0-rc.8",
            "v2.0.0-rc.7-patch.8",
            "v2.0.0-rc.7-patch.7",
            "v2.0.0-rc.7-patch.6",
            "v2.0.0-rc.7-patch.5",
            "v2.0.0-rc.7-patch.4",
            "v2.0.0-rc.7-patch.3",
            "v2.0.0-rc.7-patch.2",
            "v2.0.0-rc.7",
            "v2.0.0-rc.6-patch.5",
            "v2.0.0-rc.6-patch.4",
            "v2.0.0-rc.6-patch.3",
            "v2.0.0-rc.6-patch.2",
            "v2.0.0-rc.6-patch.1",
            "v2.0.0-rc.6",
            "v2.0.0-rc.5",
            "v2.0.0-rc.4-patch.3",
            "v2.0.0-rc.4-patch.2",
            "v2.0.0-rc.4-patch.1",
            "v2.0.0-rc.4",
            "v2.0.0-rc.3-patch.1",
            "v2.0.0-rc.3",
            "v2.0.0-rc.2",
            "v2.0.0-rc.1-patch.2",
            "v2.0.0-rc.1-patch.1",
            "v2.0.0-rc.1",
            "v2.0.0-beta.42",
            "v2.0.0-beta.41",
            "v2.0.0-beta.40",
            "v2.0.0-beta.39",
            "v2.0.0-beta.38",
            "v2.0.0-beta.37-patch.5",
            "v2.0.0-beta.37-patch.4",
            "v2.0.0-beta.37-patch.3",
            "v2.0.0-beta.37-patch.2",
            "v2.0.0-beta.37-patch.1",
            "v2.0.0-beta.37",
            "v2.0.0-beta.36",
            "v2.0.0-beta.35",
            "v2.0.0-beta.34",
            "v2.0.0-beta.33",
            "v2.0.0-beta.32-patch.1",
            "v2.0.0-beta.32",
            "v2.0.0-beta.31",
            "v2.0.0-beta.30",
            "v2.0.0-beta.29",
            "v2.0.0-beta.28",
            "v2.0.0-beta.27",
            "v2.0.0-beta.26",
            "v2.0.0-beta.25-patch.2",
            "v2.0.0-beta.25-patch.1",
            "v2.0.0-beta.25",
            "v2.0.0-beta.24",
            "v2.0.0-beta.23-patch.2",
            "v2.0.0-beta.23-patch.1",
            "v2.0.0-beta.23",
            "v2.0.0-beta.22",
            "v2.0.0-beta.21",
            "v2.0.0-beta.20",
            "v2.0.0-beta.19",
            "v2.0.0-beta.18-patch.2",
            "v2.0.0-beta.18-patch.1",
            "v2.0.0-beta.18",
            "v2.0.0-beta.17",
            "v2.0.0-beta.16",
            "v2.0.0-beta.15",
            "v2.0.0-beta.14",
            "v2.0.0-beta.13-patch",
            "v2.0.0-beta.13",
            "v2.0.0-beta.12",
            "v2.0.0-beta.11",
            "v2.0.0-beta.10-patch",
            "v2.0.0-beta.10",
            "v2.0.0-beta.9",
            "v2.0.0-beta.8-patch",
            "v2.0.0-beta.8",
            "v2.0.0-beta.7",
            "v2.0.0-beta.6-patch.2",
            "v2.0.0-beta.6-patch",
            "v2.0.0-beta.6",
            "v2.0.0-beta.5-patch",
            "v2.0.0-beta.5",
            "v2.0.0-beta.4-patch",
            "v2.0.0-beta.4",
            "v2.0.0-beta.3",
            "v2.0.0-beta.2",
            "v2.0.0-beta.1",
            "v1.9.9-4",
            "v1.9.9-3",
            "v1.9.9-2",
            "v1.9.9",
            "v1.9.9-1",
            "v1.8.4-patch",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.9",
            "v1.7.8",
            "v1.7.7",
            "v1.7.6",
            "v1.7.5",
            "v1.7.4",
            "v1.7.3",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0-patch",
            "v1.7.0",
            "v1.6.8",
            "v1.6.7",
            "v1.6.6",
            "v1.6.5",
            "v1.6.3",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0-fix",
            "v1.6.0",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.5.0-beta9",
            "v1.5.0-beta8",
            "v1.5.0-beta7",
            "v1.5.0-beta6",
            "v1.5.0-beta5",
            "v1.5.0-beta4-fix",
            "v1.5.0-beta4",
            "v1.5.0-beta3",
            "v1.5.0-beta2",
            "v1.5.0-beta1",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.4.0-rc1",
            "v1.3.3-rc1",
            "v1.3.2",
            "v1.3.1-fix",
            "v1.3.1",
            "v1.3.0",
            "v1.3.0-rc1",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0-rc.3",
            "v1.2.0",
            "v1.2.0-rc.2",
            "v1.2.0-rc.1",
            "v1.2.0-alpha.4",
            "v1.2.0-alpha.3",
            "v1.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84319.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.907998063Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1",
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84319.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84319",
        "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-693"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84319.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-84319",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 518457,
  "published_at": "2026-10-12T21:03:36.112+00:00"
}