Live › vulnerability › CVE-2026-84360
Go to dashboardNginx UI, a web interface for managing Nginx, lets an OTP-protected user skip the second-factor step-up check by calling its MCP endpoints. An attacker holding only a normal login token can create or modify Nginx configuration and trigger reloads.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | < 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
Confirm you run Nginx UI from the Go module github.com/0xJacky/Nginx-UI older than 1.9.10-0.20260703131214-23d1934099b0 (sources say fixed in 2.4.1 per the description).
2.4.1 or later (sources give fixed pseudo-version 1.9.10-0.20260703131214-23d1934099b0 for the Go module)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-84360")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.