{"id":"EUVD-2026-97907","enisaUuid":"698a3f5d-3b06-3282-acb8-025064c72aef","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 9:08:04 PM","dateUpdated":"Oct 13, 2026, 2:00:35 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","aliases":"CVE-2026-84360\nGHSA-vc32-4gwf-77xp\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"a59b9b7c-7a2e-3c52-898c-008df46a6705","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"enisaIdVendor":[{"id":"ee208793-5f58-3be8-acf5-5c4bf902bac5","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"483f4dbc-9764-3a12-b174-b8d67561cefb","vulnerability":{"id":"GHSA-vc32-4gwf-77xp","description":"Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools","datePublished":"Oct 15, 2026, 8:14:10 PM","dateUpdated":"Oct 15, 2026, 8:14:10 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84360\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97907\n","aliases":"CVE-2026-84360\nGHSA-vc32-4gwf-77xp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d88b9b82-3beb-34ba-a15e-2f50fd3cd320","vulnerability":{"id":"CVE-2026-84360","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 9:08:04 PM","dateUpdated":"Oct 13, 2026, 2:00:35 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97907\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Nov 5, 2026, 7:13:27 AM","vulnerabilityProduct":[{"id":"e3ad80fa-0304-3a0e-bd2d-ee533b23ba99","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"vulnerabilityVendor":[{"id":"5a0ff24f-dedc-33da-bd40-739771dc6b09","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}