CVE-2026-60062: NGINX Agent Vulnerability
The NGINX Agent configdirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The configdirs directive required for this issue can also be configured through NGINX Instance Manager. A successful exploit may allow an attacker to cross a security boundary.
Impact: A remotely authenticated low-privileged attacker could gain limited read and write access outside of the list of directories specified in the NGINX Agent configuration.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure the NGINX Agent config_dirs directive (also configurable through NGINX Instance Manager) is set to only the specific directories required, preventing access to files outside the designated secure directory.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60062?
The severity of CVE-2026-60062 is medium with a score of 6.4.
How do I fix CVE-2026-60062?
To mitigate CVE-2026-60062, restrict the config_dirs directive to allow access only to designated secure directories.
What type of attack is CVE-2026-60062 associated with?
CVE-2026-60062 is associated with a path traversal vulnerability.
Who is affected by CVE-2026-60062?
NGINX Agent users who have configured the config_dirs directive are affected by CVE-2026-60062.
What can an attacker do with CVE-2026-60062?
An attacker can gain limited read and write access to files outside of the designated secure directory.