Nginx UI Web Interface Vulnerability in Nginx Web Server by Nginx

CVE-2026-84360

What is CVE-2026-84360?

The Nginx UI provides a web-based interface for managing Nginx configurations. In versions prior to 2.4.1, it fails to appropriately enforce security measures on certain HTTP configuration mutation routes. Specifically, the routes /mcp and /mcp_message allow users with merely ordinary authentication—bypassing the necessary RequireSecureSession— to create or alter Nginx configurations. This loophole can be exploited by an OTP-enabled user possessing a standard JWT without a valid X-Secure-Session-ID, enabling unauthorized configuration changes and potential service disruptions. The issue has been rectified in version 2.4.1.

References