{"id":"CVE-2026-84360","kind":"vulnerability","aliases":["CVE-2026-84360","GHSA-vc32-4gwf-77xp","GO-2026-6799"],"related":[],"title":"Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.","summary":"Nginx UI, a web interface for managing Nginx, lets an OTP-protected user skip the second-factor step-up check by calling its MCP endpoints. An attacker holding only a normal login token can create or modify Nginx configuration and trigger reloads.","severity":"high","cvss":8.1,"epss":0.00347,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260703131214-23d1934099b0"],"affected":"< 1.9.10-0.20260703131214-23d1934099b0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["no-mcp-exposure","otp-disabled"],"how_to_check":"Confirm you run Nginx UI from the Go module github.com/0xJacky/Nginx-UI older than 1.9.10-0.20260703131214-23d1934099b0 (sources say fixed in 2.4.1 per the description).","fix":"Upgrade Nginx UI to 2.4.1 or later (sources give fixed pseudo-version 1.9.10-0.20260703131214-23d1934099b0 for the Go module).\nRotate sessions and JWTs for users if exposure is suspected.","status":"open","published_at":"2026-10-12T21:17:22+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:45+00:00","updated_at":"2026-10-23T19:52:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:52:45Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Nginx UI to 2.4.1 or later (sources give fixed pseudo-version 1.9.10-0.20260703131214-23d1934099b0 for the Go module).\nRotate sessions and JWTs for users if exposure is suspected.","summary":"Nginx UI, a web interface for managing Nginx, lets an OTP-protected user skip the second-factor step-up check by calling its MCP endpoints. An attacker holding only a normal login token can create or modify Nginx configuration and trigger reloads.","category":"package","who_cares":["nginx-ui","self-hosted","go","nginx"],"confidence":0.8,"analyst_note":"Sources conflict on fixed version (module pseudo-version 1.9.10-... vs description saying 2.4.1); verify the release tag and whether /mcp is reachable on default deployments at https://pkg.go.dev/vuln/GO-2026-6799.","how_to_check":"Confirm you run Nginx UI from the Go module github.com/0xJacky/Nginx-UI older than 1.9.10-0.20260703131214-23d1934099b0 (sources say fixed in 2.4.1 per the description).\nunknown","needs_analyst":true,"not_affected_if":["otp-disabled","no-mcp-exposure"],"severity_if_unknown":"high"},"cost_usd":0.000458,"input_tokens":2279,"output_tokens":460,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':22A,30A,33A '-6799':31A '-84360':23A,34A '/0xjacky/nginx-ui':20A,37A '/mcp':115C '/mcp_message':117C '2.4.1':106C,174C '4gwf':27A '77xp':28A 'add':126C 'attack':76B 'authent':121C 'behavior':158C 'bypass':12A,161C 'call':71B 'check':69B 'config':125C,129C 'configur':15A,88B,109C,154C 'control':167C 'creat':84B,150C 'cve':21A,32A 'enabl':134C 'endpoint':74B 'expos':123C 'factor':65B 'fix':171C 'ghsa':25A 'ghsa-vc32-4gwf-77xp':24A 'github.com':19A,36A 'github.com/0xjacky/nginx-ui':18A,35A 'go':29A,38B 'hold':77B 'host':46B 'http':108C 'id':147C 'intend':163C 'interfac':51B,98C 'issu':169C 'jwt':139C 'let':55B 'login':81B 'manag':53B 'mcp':14A,73B,160C 'modifi':86B,130C,152C 'mutat':110C 'nginx':1A,39B,41B,47B,54B,87B,92C,101C,124C,128C,153C 'nginx-ui':40B 'normal':80B,138C 'ordinari':120C 'otp':3A,58B,133C 'otp-en':132C 'otp-protect':57B 'packag':43B 'prior':104C 'protect':59B 'reload':91B,157C 'requir':112C,118C 'requiresecuresess':113C 'rout':111C 'second':64B 'second-factor':63B 'secur':5A,145C 'secure-sess':4A 'self':45B 'self-host':44B 'server':103C 'session':6A,146C 'skip':61B 'step':8A,67B,165C 'step-up':7A,66B,164C 'therefor':149C 'token':82B 'tool':16A 'trigger':90B,156C 'ui':2A,42B,48B,93C 'user':60B,97C,135C 'valid':142C 'vc32':26A 'version':173C 'via':13A 'web':50B,96C,102C 'x':144C 'x-secure-session-id':143C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T21:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6799","url":"https://pkg.go.dev/vuln/GO-2026-6799","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84360","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84360","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-84360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84360","severity":null,"published_at":"2026-10-12T21:17:22+00:00","modified_at":"2026-10-13T14:31:20+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}