CVE-2026-84316: Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted loadmodule, jsimport, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginxconfigmodify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nginx UIto a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Nginx UI caller who can use configuration-writing functionality is required. The affected write paths include REST, nginx_config_modify, site, and stream operations.
What conditions make code execution possible?
The validation bypass permits injection of restricted directives, including load_module, js_import, perl, and user root, as well as loading restricted content through an unrestricted include directive. Code execution in the Nginx worker context is possible when an executable module is available.
Which deployments are affected and what version fixes it?
Nginx UI versions prior to 2.4.1 are affected. Version 2.4.1 fixes the issue.
How can an administrator identify potentially malicious configuration changes?
Review configuration written through Nginx UI for multiple semicolon-separated directives on a single line, especially where a benign first directive is followed by load_module, js_import, perl, or user root. Also inspect include directives for loading content containing restricted directives.