CVE-2026-84316High· 8.8▾ MidnightPoC availableNginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolo…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Exploit / PoC code exists
0.4% → 0.5%
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/0xJacky/Nginx-UI < 1.9.10-0.20260703131214-23d1934099b0Patched in:
github.com/0xJacky/Nginx-UI 1.9.10-0.20260703131214-23d1934099b0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84317High· 8.8Nginx UI is a web user interface for the Nginx web server
CVE-2026-84312High· 7.1Nginx UI is a web user interface for the Nginx web server
CVE-2026-84321Medium· 5.4Nginx UI is a web user interface for the Nginx web server
CVE-2026-84360High· 8.1Nginx UI is a web user interface for the Nginx web server
CVE-2026-84318High· 8.8Nginx UI is a web user interface for the Nginx web server
CVE-2026-84313High· 8.8Nginx UI is a web user interface for the Nginx web server