CVE-2026-84317: Nginx UI Authentication Bypass RCE Vulnerability

CVE-2026-84317 Overview

CVE-2026-84317 is an input validation flaw [CWE-20] in Nginx UI, a web user interface for managing the Nginx web server. The project enforces a ValidateConfigFile control in internal/config/validation.go that blocks dangerous directives such as js_*, perl_*, load_module for the njs/perl modules, and user root. The control is applied on three of four config-write paths but is missing from the Model Context Protocol (MCP) tool nginx_config_add in mcp/config/config_add.go. An authenticated MCP caller, or an MCP agent manipulated through prompt injection, can write arbitrary directives to disk and trigger an nginx reload. The issue affects Nginx UI versions prior to 2.4.1.

Critical Impact
Authenticated MCP callers can inject blocked nginx directives and achieve nginx code execution on deployments where the njs or perl modules are available, including the official Docker image.

Affected Products

Nginx UI versions prior to 2.4.1
Nginx UI official Docker image (ships with njs/perl modules available)
Deployments exposing the MCP interface to authenticated users or AI agents

Discovery Timeline

2026-10-12 - CVE-2026-84317 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-84317

Vulnerability Analysis

Nginx UI centralizes dangerous-directive blocking in ValidateConfigFile, defined in internal/config/validation.go. The function rejects nginx configurations that load the njs or perl modules, invoke js_* or perl_* directives, or set user root. These directives are blocked because they allow arbitrary code execution inside the nginx worker process.

The validator is invoked from three config-write endpoints: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth write path, the MCP tool nginx_config_add in mcp/config/config_add.go, does not call the validator. It writes caller-supplied content directly to disk and reloads nginx. The missing call allows an authenticated MCP client to bypass the entire directive deny-list.

On deployments where the njs or perl modules are installed, including the official Docker image, injecting a load_module directive followed by a js_* or perl_* block yields nginx worker code execution.

Root Cause

The root cause is inconsistent application of a security control across functionally equivalent code paths. The nginx_config_add MCP tool duplicates the write-and-reload behavior of the REST add endpoint but omits the ValidateConfigFile call that the REST path performs. This is a classic input validation gap [CWE-20] produced by missing enforcement rather than a flawed check.

Attack Vector

An attacker needs authenticated access to the MCP interface, or the ability to inject prompts into an MCP-connected AI agent that proxies requests to Nginx UI. The attacker invokes nginx_config_add with a payload containing load_module plus an njs or perl directive block that executes attacker-controlled code. Nginx UI writes the file and reloads nginx, loading the module and executing the embedded code inside the worker process.

The maintainer patch in commit 23d1934 tightens routing for related sensitive endpoints by requiring middleware.RequireSecureSession() on backup, DNS credential, and certificate mutation routes:

// api/backup/router.go — before vs after
-	r.GET("/backup", middleware.AuthRequired(), CreateBackup)
+	r.GET("/backup", middleware.AuthRequired(), middleware.RequireSecureSession(), CreateBackup)
 	r.POST("/restore", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)

// api/certificate/router.go — grouping mutation routes under RequireSecureSession
+	o := r.Group("", middleware.RequireSecureSession())
+	{
+		o.POST("dns_credentials", AddDnsCredential)
+		o.POST("dns_credentials/:id", EditDnsCredential)
+		o.DELETE("dns_credentials/:id", DeleteDnsCredential)
+	}

Source: GitHub commit 23d1934

Detection Methods for CVE-2026-84317

Indicators of Compromise

Unexpected load_module directives referencing ngx_http_js_module or ngx_http_perl_module inside Nginx UI–managed config files
Presence of js_content, js_set, perl_set, or similar directives in configurations written through Nginx UI
Nginx reload events immediately following MCP nginx_config_add tool invocations from non-interactive sessions
New or modified .conf files under the Nginx UI config directory with no corresponding entry in the REST audit log

Detection Strategies

Parse managed nginx configuration files and alert on any directive matching js_*, perl_*, load_module, or user root
Correlate Nginx UI MCP tool-call logs with filesystem writes to the nginx config directory to flag writes that lack a matching REST request
Monitor child processes spawned by nginx worker processes; njs and perl modules executing shell commands are high-signal indicators

Monitoring Recommendations

Enable verbose logging on the MCP interface and ship logs to a centralized store for retention and search
Baseline the set of loaded nginx modules at startup and alert on dynamic load_module additions
Track authentication events against the MCP endpoint and alert on new client identities or unusual tool-call volume

How to Mitigate CVE-2026-84317

Immediate Actions Required

Upgrade Nginx UI to version 2.4.1 or later on all deployments, including container images
Audit existing nginx configuration files for js_*, perl_*, load_module, or user root directives and remove any that were not deliberately introduced
Rotate MCP authentication credentials and review the list of authorized MCP clients and agents
Restrict network exposure of the MCP interface to trusted hosts only

Patch Information

The vulnerability is fixed in Nginx UI 2.4.1. See the GitHub Release v2.4.1, the GitHub Security Advisory GHSA-76pm-mq2q-9gcr, and the fix commit 23d1934 for full details.

Workarounds

Disable the MCP interface entirely until the upgrade can be applied
Rebuild the Nginx UI container without the njs and perl modules to remove the code-execution primitive
Place Nginx UI behind a reverse proxy that strips or inspects MCP tool-call payloads for banned directives
Run nginx as a non-privileged user and apply filesystem-level write protections on config directories

bash

# Verify installed version and upgrade via Docker
docker pull uozi/nginx-ui:2.4.1
docker stop nginx-ui && docker rm nginx-ui
docker run -d --name nginx-ui -p 8080:80 uozi/nginx-ui:2.4.1

# Audit existing configs for blocked directives
grep -R -nE '^\s*(load_module|js_[a-z_]+|perl_[a-z_]+|user\s+root)' /etc/nginx/