Input validation error in nginx-ui - CVE-2026-84317
Published: July 17, 2026 / Updated: October 16, 2026
Vulnerability identifier: #VU138336
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84317
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper input validation in the MCP nginx_config_add tool when processing caller-supplied nginx configuration content. A remote user can submit crafted nginx directives to execute arbitrary code.
Code execution is achievable on deployments where the njs or perl module is available, including the official Docker image. On stock nginx without those modules, the issue can still cause a denial of service by triggering a failed reload. The vulnerable write path is limited to the nginx configuration directory, but the main nginx.conf file within that directory can be overwritten.
Affected software
nginx-ui
How to mitigate CVE-2026-84317
Install security update from vendor's website.
nginx-ui - update to 2.4.0