CVE-2026-84318High· 8.8▾ MidnightPoC availableNginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The id…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
Exploit / PoC code exists
0.6% → 0.8%
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/0xJacky/Nginx-UI >= 1.9.10-0.20250506154222-1330888280a2, < 1.9.10-0.20260703131214-23d1934099b0Patched in:
github.com/0xJacky/Nginx-UI 1.9.10-0.20260703131214-23d1934099b0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84317High· 8.8Nginx UI is a web user interface for the Nginx web server
CVE-2026-84319High· 8.3Nginx UI is a web user interface for the Nginx web server
CVE-2026-84312High· 7.1Nginx UI is a web user interface for the Nginx web server
CVE-2026-84321Medium· 5.4Nginx UI is a web user interface for the Nginx web server
CVE-2026-84360High· 8.1Nginx UI is a web user interface for the Nginx web server
CVE-2026-84316High· 8.8Nginx UI is a web user interface for the Nginx web server