CVE-2026-84318: Nginx UI Config Bypass RCE Vulnerability

CVE-2026-84318 Overview

CVE-2026-84318 is a security control bypass in Nginx UI, a web user interface for the Nginx web server. The vulnerability affects versions 2.0.0-rc.6 through 2.4.0. The Model Context Protocol (MCP) tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without invoking config.ValidateConfigFile. The equivalent REST API endpoint POST /api/configs correctly calls that validation function and rejects dangerous directives. An authenticated attacker can leverage this gap to write arbitrary directives that the security layer would otherwise block.

Critical Impact
On servers with the nginx Perl, njs, or Lua module loaded, exploitation results in post-authentication Remote Code Execution with the privileges of the nginx worker process.

Affected Products

Nginx UI versions 2.0.0-rc.6 through 2.4.0
Deployments exposing the MCP tool nginx_config_add to authenticated users
Nginx instances with Perl, njs (JavaScript), or Lua modules loaded alongside Nginx UI

Discovery Timeline

2026-10-12 - CVE-2026-84318 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-84318

Vulnerability Analysis

The vulnerability is a Protection Mechanism Failure [CWE-693] within the Nginx UI MCP interface. Nginx UI enforces a security layer that blocks dangerous nginx directives such as perl, js_import, load_module, and user root. This enforcement runs inside config.ValidateConfigFile, which is called by the REST handler POST /api/configs before configuration files are written to disk.

The parallel MCP tool nginx_config_add performs the same write-and-reload flow but skips the validation call. Authenticated attackers who can reach the MCP tool therefore write configuration files containing directives the REST path would reject. When nginx reloads, the forbidden directives take effect.

On servers with the Perl, njs, or Lua modules loaded, directives like perl_set or js_content allow the attacker to execute arbitrary code inside the nginx worker. This converts a configuration-write primitive into post-authentication Remote Code Execution.

Root Cause

The root cause is inconsistent enforcement of security controls across two code paths that write nginx configuration files. The REST API handler validates input through config.ValidateConfigFile; the MCP tool handler does not. Any directive blocklist, path check, or safety guard implemented inside the validator is bypassed when attackers choose the MCP path.

Attack Vector

Exploitation requires authenticated network access to the Nginx UI MCP endpoint. The attacker invokes nginx_config_add with a payload containing a blocked directive, for example load_module modules/ngx_http_perl_module.so; combined with a perl_set block that executes shell commands. Nginx UI writes the file and triggers a reload. The nginx worker loads the module and runs the attacker-controlled code.

// Security patch excerpt from api/backup/router.go
// Source: https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
func InitRouter(r *gin.RouterGroup) {
-	r.GET("/backup", middleware.AuthRequired(), CreateBackup)
+	r.GET("/backup", middleware.AuthRequired(), middleware.RequireSecureSession(), CreateBackup)
 	r.POST("/restore", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)
}

The companion patch in api/certificate/router.go wraps credential and certificate write endpoints in a middleware.RequireSecureSession() group, enforcing consistent session validation across sensitive routes. Source: GitHub Commit 23d1934.

Detection Methods for CVE-2026-84318

Indicators of Compromise

Nginx configuration files containing perl, perl_set, js_import, js_content, load_module, or user root directives that were not deployed by administrators
Unexpected invocations of the MCP tool nginx_config_add in Nginx UI audit logs
Nginx worker processes spawning shell interpreters such as /bin/sh, /bin/bash, or scripting runtimes

Detection Strategies

Compare configuration files written through the MCP path against the directive blocklist enforced by config.ValidateConfigFile
Alert on reloads triggered immediately after MCP tool activity by non-administrative users
Monitor file integrity on /etc/nginx/ and any Nginx UI managed configuration directory for unapproved changes

Monitoring Recommendations

Enable verbose audit logging on Nginx UI and forward events to a centralized logging platform for correlation
Watch for new process trees descending from nginx: worker process executing non-standard binaries
Track outbound network connections from the nginx host to unexpected destinations after configuration changes

How to Mitigate CVE-2026-84318

Immediate Actions Required

Upgrade Nginx UI to version 2.4.1 or later, which adds config.ValidateConfigFile to the MCP tool flow
Rotate Nginx UI user credentials and API tokens in case authenticated access has been abused
Audit nginx configuration files for unauthorized perl, js_*, load_module, or user root directives

Patch Information

The fix is available in Nginx UI 2.4.1. The patch adds the missing validation call to the MCP tool handler so that the directive blocklist is enforced regardless of entry point. Review the GitHub Security Advisory GHSA-9jww-cxg5-rj9m and the GitHub Release 2.4.1 notes for full remediation details.

Workarounds

Disable the MCP interface in Nginx UI configuration until the upgrade can be completed
Restrict Nginx UI network exposure to trusted administrative networks using firewall rules or a reverse proxy with mutual TLS
Remove the nginx Perl, njs, and Lua modules from systems that do not require them to limit the code execution impact of a successful bypass

bash

# Verify the installed Nginx UI version and upgrade if below 2.4.1
nginx-ui -v

# Scan existing configuration files for directives that should be blocked
grep -RnE '^(\s*)(perl|perl_set|js_import|js_content|load_module|user\s+root)\b' /etc/nginx/