CVE-2026-84360: Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nginx UIto a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Nginx UI user with OTP enabled can exploit it using a normal JWT, even if they do not have a valid X-Secure-Session-ID for the OTP-secured step-up session.
What access does an attacker need to make the bypass useful?
The attacker needs ordinary authenticated access to Nginx UI and access to the MCP endpoints. The affected MCP configuration tools, nginx_config_add and nginx_config_modify, can create or modify Nginx configuration and trigger reload behavior.
Are deployments without OTP-enabled users affected in the same way?
The described bypass specifically concerns an OTP-enabled user bypassing the intended secure-session step-up requirement. The available information does not establish the impact for users or deployments that do not use OTP.
What versions should be remediated?
Nginx UI versions prior to 2.4.1 are affected. Version 2.4.1 fixes the issue.