Nginx UI flaws let MCP tools skip config security checks

Three vulnerabilities in Nginx UI, the web-based management tool for the Nginx web server from developer 0xJacky, let authenticated users bypass security controls through its MCP interface, according to GitHub security advisories published on 15 October 2026. MCP, the Model Context Protocol, is the interface Nginx UI exposes for AI agents and other clients. The core problem is that the MCP configuration tools do not apply the same validation checks that the HTTP API enforces.

The first flaw, tracked as CVE-2026-84318, concerns the MCP tool nginx_config_add. According to the advisory, the REST API endpoint POST /api/configs calls a function named config.ValidateConfigFile before writing a configuration file, which rejects a blocklist of dangerous directives such as perl, js_import, load_module and user root. The MCP code path omits that call entirely and writes the file directly, then reloads Nginx automatically. The advisory states that on a server running Nginx with the Perl, njs or Lua module loaded, this results in post-authentication remote code execution. Its proof of concept writes a perl configuration that the REST API rejects, applies it through MCP, and runs an operating system command as the nginx worker user. The advisory adds that a user root directive, also unblocked on this path, could escalate the worker to root.

The second flaw, CVE-2026-84319, covers the same bypass but focuses on NJS, the JavaScript module for Nginx. The advisory says a secondary authenticated user can use nginx_config_add to load ngx_http_js_module.so, import attacker-controlled JavaScript and execute it inside the Nginx worker context. In the lab, the researcher confirmed that content rejected by the HTTP API, including the restricted directives load_module, js_import and js_content, could be applied through MCP and executed. The advisory notes this is authenticated and is not operating system command execution by itself, but may allow modification of Nginx runtime behaviour including responses, routing, headers and redirects.

The third flaw, CVE-2026-84360, concerns one-time password protection. According to the advisory, the HTTP configuration endpoints are grouped behind a middleware named RequireSecureSession, which forces OTP-enabled users to complete a secure session before high-impact changes. The MCP endpoints /mcp and /mcp_message are exposed with only ordinary authentication. The researcher verified locally that an OTP-enabled user could open an authenticated session and call nginx_config_add without any secure-session step-up, writing a configuration file and triggering a reload. The advisory describes this as a security-control bypass rather than a missing feature.

All three advisories note that the MCP endpoints accept the same JWT and node-secret tokens as the REST API, so the attack surface is any authenticated session where MCP is enabled. The advisories say the MCP tool nginx_config_modify already calls ValidateConfigFile correctly, so only config_add.go is affected for the directive bypass. The suggested fix is to apply the same ValidateConfigFile validation before MCP configuration writes and to share validation tests between the HTTP API and MCP. The advisories list the status as reported.