CVE-2026-84317 0xJacky CVE debrief

Who should care

Defenders responsible for Nginx UI deployments, especially those using the official Docker image, should assess exposure and verify the version of Nginx UI. They should also implement additional security controls to prevent exploitation and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-84317 is an authenticated nginx directive injection vulnerability in Nginx UI. Defenders should prioritize verifying exposure and assessing the impact on their systems, especially those using the official Docker image.

• Potential code execution on deployments with the njs/perl module available
• Authenticated nginx directive injection
• Verification of exposure and impact is necessary

Technical summary

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives. However, the MCP tool nginx_config_add skips this validation, allowing an authenticated MCP caller to inject blocked directives. This can lead to potential code execution on deployments with the njs/perl module available. The vulnerability is fixed in version 2.4.1. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the official Docker image.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the official Docker image.

Recommended defensive actions

• Verify the version of Nginx UI and ensure it is 2.4.1 or later
• Assess the impact of this vulnerability on systems using the official Docker image
• Implement additional security controls to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on this issue. The official Docker image is affected, and an authenticated MCP caller can inject blocked nginx directives. The vulnerability is caused by the MCP tool nginx_config_add skipping validation of config directives. Defenders should verify exposure and assess the impact on their systems, especially those using the official Docker image. The source item providing details on the vulnerability also confirms the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.