{"id":"EUVD-2026-97908","enisaUuid":"62528cfe-01bd-3440-9eda-45da90c398fc","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui\u0027s entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 8:20:18 PM","dateUpdated":"Oct 13, 2026, 2:59:04 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","aliases":"CVE-2026-84318\nGHSA-9jww-cxg5-rj9m\n","assigner":"GitHub_M","epss":0.82,"enisaIdProduct":[{"id":"1e961fd2-3a73-3482-9373-04d3ca670898","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0-rc.6, \u003c 2.4.1"}],"enisaIdVendor":[{"id":"747f5a61-b13a-33f8-bd76-7a3f7a66fac5","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"a800dc9d-34ca-3852-bb72-1f063c1d2832","vulnerability":{"id":"CVE-2026-84318","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui\u0027s entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 8:20:18 PM","dateUpdated":"Oct 13, 2026, 2:59:04 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97908\n","assigner":"GitHub_M","epss":0.82,"dataProcessed":"Nov 1, 2026, 7:14:05 AM","vulnerabilityProduct":[{"id":"94cc2166-b5f7-33c1-9198-6446583ab4f7","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0-rc.6, \u003c 2.4.1"}],"vulnerabilityVendor":[{"id":"f8669d05-25fc-3289-88b6-aea9774072e8","vendor":{"name":"0xJacky"}}]}},{"id":"b1da94d4-7619-3aeb-9bf1-b08b09a7023d","vulnerability":{"id":"GHSA-9jww-cxg5-rj9m","description":"Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE","datePublished":"Oct 15, 2026, 8:11:18 PM","dateUpdated":"Oct 15, 2026, 8:11:18 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84318\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97908\n","aliases":"GHSA-9jww-cxg5-rj9m\nCVE-2026-84318\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}