CVE-2026-84316: Nginx UI Configuration Bypass RCE Vulnerability

CVE-2026-84316 Overview

CVE-2026-84316 is a configuration validation bypass in Nginx UI, a web user interface for managing the Nginx web server. The config.ValidateConfigDirectives function splits configuration input by newline and inspects only the first directive token on each line. Nginx itself permits multiple semicolon-separated directives per line, so an authenticated user can hide restricted directives behind a benign one. The flaw affects REST, nginx_config_modify, site, and stream write paths. When an executable Nginx module is available on the host, injected directives such as load_module, js_import, perl, or user root can execute code in the Nginx worker context. The issue is fixed in version 2.4.1.

Critical Impact
An authenticated attacker can bypass directive allow-listing and achieve code execution in the Nginx worker process, potentially as root.

Affected Products

Nginx UI versions prior to 2.4.1
Deployments exposing REST and nginx_config_modify write paths
Instances with loadable Nginx modules such as ngx_http_js_module or ngx_http_perl_module available

Discovery Timeline

2026-10-12 - CVE-2026-84316 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-84316

Vulnerability Analysis

The weakness is classified as [CWE-20] Improper Input Validation. Nginx UI enforces a denylist on directives like load_module, js_import, perl, and user to prevent privileged configuration changes. The validator in config.ValidateConfigDirectives tokenizes each configuration line and evaluates only the first directive. Because Nginx accepts multiple directives separated by semicolons on a single line, any directive after the first escapes inspection. An authenticated caller writing configuration through REST, nginx_config_modify, site, or stream endpoints can smuggle restricted directives past the check. The attacker can also abuse an unrestricted include directive to pull in files that contain restricted content, achieving the same bypass. When Nginx is built or packaged with executable modules such as ngx_http_js_module or ngx_http_perl_module, the injected configuration executes code inside the Nginx worker.

Root Cause

The validator parses configuration using a line-oriented model while Nginx parses it using a semicolon-oriented model. This parser differential means the validator and the enforcement engine disagree on where a directive ends, allowing hidden directives to pass validation.

Attack Vector

Exploitation requires an authenticated session with permission to write Nginx configuration through the UI or API. The attacker submits a configuration snippet where a benign directive appears first, followed by a semicolon and a restricted directive on the same line. Alternatively, the attacker uses an include directive to reference an attacker-controlled file containing restricted content. On reload, Nginx honors every directive, loading modules or changing the worker user as directed.

// Patch excerpt: api/backup/router.go — enforce secure-session middleware
 func InitRouter(r *gin.RouterGroup) {
-	r.GET("/backup", middleware.AuthRequired(), CreateBackup)
+	r.GET("/backup", middleware.AuthRequired(), middleware.RequireSecureSession(), CreateBackup)
 	r.POST("/restore", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)
 }

Source: GitHub commit 23d1934. The fix hardens adjacent sensitive endpoints with RequireSecureSession() as part of the broader advisory remediation.

Detection Methods for CVE-2026-84316

Indicators of Compromise

Nginx configuration files containing multiple semicolon-separated directives on a single line, especially where a trailing directive is load_module, js_import, perl, or user root.
Unexpected include directives referencing paths outside the standard Nginx UI managed configuration tree.
Nginx worker processes running as root on systems where workers normally run as nginx or www-data.
New or unexpected shared object files loaded by Nginx workers, visible in /proc/<pid>/maps.

Detection Strategies

Audit all configuration diffs submitted through Nginx UI REST, nginx_config_modify, site, and stream endpoints for inline semicolon-chained directives.
Run post-write validation that re-parses saved configuration with an Nginx-aware tokenizer rather than a line splitter.
Correlate Nginx UI authentication logs with configuration change events to identify low-privilege accounts performing module or user directive changes.

Monitoring Recommendations

Alert on any configuration write path that produces output containing load_module, js_import, perl, or user directives.
Monitor the Nginx master process for runtime UID changes and for dlopen activity on modules outside the approved module directory.
Collect file integrity monitoring events on /etc/nginx/ and any Nginx UI-managed configuration directory.

How to Mitigate CVE-2026-84316

Immediate Actions Required

Upgrade Nginx UI to version 2.4.1 or later on all instances.
Rotate credentials for every Nginx UI account and revoke active sessions after upgrading.
Review all configuration files written since deployment for smuggled directives and unauthorized include statements.
Restrict network access to the Nginx UI management interface to trusted administrative networks only.

Patch Information

The fix is published in Nginx UI release v2.4.1 with code changes in commit 23d1934. Full advisory details are available in GHSA-cf23-7qxj-xmhr.

Workarounds

Remove or disable executable Nginx modules such as ngx_http_js_module and ngx_http_perl_module on hosts that do not require them.
Run the Nginx master process under a non-root account where the deployment model allows it.
Restrict Nginx UI user permissions so that only trusted administrators can write configuration until the upgrade is complete.

bash

# Upgrade Nginx UI to the patched release
docker pull uozi/nginx-ui:2.4.1
docker stop nginx-ui && docker rm nginx-ui
docker run -d --name nginx-ui \
  -v /etc/nginx:/etc/nginx \
  -v /etc/nginx-ui:/etc/nginx-ui \
  -p 127.0.0.1:9000:9000 \
  uozi/nginx-ui:2.4.1

# Verify the installed version
docker exec nginx-ui nginx-ui -version