Nginx-UI Config Validator Bypass Enables Directive Injection
A flaw in Nginx-UI allows authenticated users to bypass security controls by splitting directives on single lines, leading to potential code execution.
Key points
- CVE-2026-84316 allows bypass of the config validator in Nginx-UI versions prior to 1.9.10-0.20260703131214-23d1934099b0.
- The flaw permits injection of blocked directives like user root or njs modules.
- Attackers can exploit this through multiple API endpoints and MCP tools.
Nginx-UI contains a high-severity configuration validation flaw that enables authenticated users to inject dangerous nginx directives. This bypass affects environments using the web interface for configuration management, exposing them to unauthorized code execution risks if specific modules are loaded.
Root cause
The validation logic splits configuration content by newlines and inspects only the first token of each line. Because nginx processes directives separated by semicolons on the same line, attackers can place a benign directive first and a blocked one after a semicolon. This defeats the scanner, which fails to detect the second directive.
Attack path
An authenticated caller can exploit this through multiple paths, including POST /api/configs, the REST config modify endpoint, and the MCP nginx_config_modify tool. Site and stream save paths are also vulnerable. If the nginx instance loads njs or perl modules, this leads to code execution in the worker process.
Affected versions
- Nginx-UI versions prior to 1.9.10-0.20260703131214-23d1934099b0 are vulnerable.
- The official uozi/nginx-ui Docker image ships with ngx_http_js_module.so, increasing risk.
- The patched version is 1.9.10-0.20260703131214-23d1934099b0.
Mitigation
- Update Nginx-UI to version 1.9.10-0.20260703131214-23d1934099b0 to apply the vendor fix.
- Restrict access to configuration APIs to trusted administrators only.
- Monitor nginx worker processes for unexpected resource usage or new modules.
Detection notes
Security teams should review nginx error logs for syntax issues related to unexpected directives. Check for unauthorized changes in configuration files, especially those containing semicolons on single lines. Monitor API access logs for unusual POST requests to config endpoints. Look for new dynamic modules loading in nginx workers.
What to do and how to stay safe: Nginx-UI
- Verify your Nginx-UI version and update if it is below 1.9.10-0.20260703131214-23d1934099b0.
- Audit recent configuration changes for multi-directive lines separated by semicolons.
- Review access logs for unauthorized API usage to configuration endpoints.
- Ensure nginx modules like njs are only loaded if explicitly required.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-84316?
It is a high-severity flaw in Nginx-UI that allows bypassing config validation by splitting directives on single lines.
Which versions of Nginx-UI are affected?
Versions prior to 1.9.10-0.20260703131214-23d1934099b0 are vulnerable to this bypass.
How can this lead to code execution?
If nginx loads njs or perl modules, injected directives can execute code in the worker process.
