CVE-2026-84318

Summary

Nginx UI allows authenticated attackers to bypass security controls and write dangerous nginx configuration directives that would normally be blocked, leading to potential remote code execution when nginx modules like Perl, njs, or Lua are installed.

Exploitability

Exploitation requires an authenticated user account with access to the MCP tool nginx_config_add functionality, which is relatively easy to achieve in environments where Nginx UI is deployed.

Blast radius

The impact could be significant across all servers running vulnerable Nginx UI versions that have nginx modules loaded, potentially allowing attackers to execute arbitrary code on the host system.

Detection

Monitor for unusual file writes to nginx configuration directories by user accounts with MCP access, particularly when followed by nginx reload processes.

Prioritized remediation

Upgrade to version 2.4.1 or later to fix the configuration validation gap in the MCP tool.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.