CVE-2026-84360: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-84360 is an authentication bypass vulnerability in Nginx UI, a web-based management interface for the Nginx web server. Prior to version 2.4.1, the /mcp and /mcp_message endpoints (Model Context Protocol routes) enforce only ordinary JWT authentication (AuthRequired) rather than the stricter step-up secure session control (RequireSecureSession) applied to other HTTP configuration mutation routes. This allows an OTP-enabled user with a valid JWT but no X-Secure-Session-ID to create or modify Nginx configuration files and trigger reload behavior, bypassing the intended multi-factor step-up control. All versions of nginx-ui up to and including 2.4.0 are affected. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Nginx UI's HTTP configuration mutation routes (e.g., in api/config/router.go) are grouped behind middleware.RequireSecureSession(), which enforces OTP step-up verification via a valid X-Secure-Session-ID header. However, the MCP server routes defined in mcp/router.go are only protected by middleware.AuthRequired() (JWT validation), and they expose the same high-impact tools — nginx_config_add and nginx_config_modify — without the step-up check. An attacker with a valid JWT for an OTP-enabled account can open an authenticated SSE connection to /mcp, initialize an MCP session via /mcp_message, and invoke these tools to write or alter Nginx configuration files without ever presenting a secure session token (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated but insufficiently privileged user to create or modify Nginx configuration files and trigger configuration reload operations, bypassing the OTP step-up authentication control. This results in high integrity impact (arbitrary configuration changes to the Nginx web server) and high availability impact (potential service disruption via malicious or malformed configurations), with no confidentiality impact. An attacker could redirect traffic, disable security controls enforced at the Nginx layer, or cause denial of service by injecting invalid configurations that crash the Nginx process (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability requires low privileges (a valid JWT for any account, including OTP-enabled accounts), no user interaction, and is exploitable over the network with low attack complexity. The EPSS score is reported as 0.0, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The advisory was authored by researcher Vincent550102 and published via GitHub Security Advisories (GitHub Advisory).

1. Obtain valid credentials: Acquire a valid username and password for any account on the target Nginx UI instance (including an OTP-enabled account). This could be through credential theft, phishing, or use of a low-privilege account.
2. Authenticate and obtain JWT: Send a standard login request to the Nginx UI authentication endpoint to receive a valid JWT token. For OTP-enabled accounts, only the JWT is needed — the OTP step-up (X-Secure-Session-ID) is not required for the MCP path.
3. Open MCP SSE connection: Send an authenticated GET request to /mcp with the Authorization header set to the JWT token and without an X-Secure-Session-ID header, establishing a Server-Sent Events (SSE) connection to the MCP server.
4. Initialize MCP session: Send a POST request to /mcp_message with the JWT token to initialize the MCP protocol session.
5. Invoke configuration mutation tool: Call the nginx_config_add or nginx_config_modify MCP tool via /mcp_message, supplying a crafted Nginx configuration payload. The server processes the request without enforcing the secure session check.
6. Trigger reload: The MCP tool triggers Nginx configuration reload behavior, applying the attacker-controlled configuration changes to the running Nginx instance (GitHub Advisory).

• Network: Authenticated HTTP requests to /mcp (SSE) and /mcp_message (POST) endpoints that lack an X-Secure-Session-ID header but carry a valid Authorization (JWT) header, especially from accounts with OTP enabled.
• Logs: Nginx UI access logs showing MCP endpoint access (/mcp, /mcp_message) by OTP-enabled users without a corresponding secure session establishment; log entries for nginx_config_add or nginx_config_modify tool invocations.
• File System: Unexpected or newly created Nginx configuration files in the managed config directory (e.g., files named with unusual patterns like mcp-bypass.conf or other attacker-chosen names) that were not created through the normal HTTP configuration UI.
• Process: Nginx reload or restart events (nginx -s reload) triggered at unusual times or frequencies, correlating with MCP endpoint activity in application logs (GitHub Advisory).

The vulnerability is fixed in Nginx UI version 2.4.1, which applies middleware.RequireSecureSession() to the MCP configuration mutation routes, consistent with the protection on HTTP configuration mutation endpoints (GitHub Release, Fix Commit). All users running nginx-ui ≤ 2.4.0 should upgrade immediately. As a temporary workaround, restrict network access to the /mcp and /mcp_message endpoints using firewall rules, reverse proxy ACLs, or network segmentation to limit exposure to trusted users only. Additionally, monitor authentication logs for suspicious access patterns to these endpoints.

The vulnerability was reported by researcher Vincent550102 and disclosed via GitHub Security Advisories by the project maintainer 0xJacky (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the advisory itself has been observed at the time of this report.