CVE-2026-84319: Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngxhttpjsmodule.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nginx UIto a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A secondary authenticated Nginx UI user can exploit it through the MCP configuration interface. Exploitation does not require user interaction and can be performed remotely over the network by an authenticated user.
What access and capabilities does an attacker need?
The attacker needs credentials for a secondary authenticated user account and access to the MCP configuration interface. They can use it to apply restricted configuration content, load the NJS module, import attacker-controlled JavaScript, and reload Nginx.
What is the resulting impact?
Successful exploitation allows attacker-controlled NJS to execute in the Nginx worker context. The reported impacts include high integrity and availability impact, with low confidentiality impact.
Which versions are affected and what fixes the issue?
Nginx UI versions prior to 2.4.1 are affected. Upgrade to version 2.4.1, which fixes the MCP interface validation bypass.