CVE-2026-84317: Nginx UI: MCP config_add bypasses directive validation

Q: Is CVE-2026-84317 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-84317, increasing the risk of exploitation.

Q: How to fix CVE-2026-84317?

1) Upgrade Nginx UI to v2.4.1 or later (the patched Go module is 1.9.10-0.20260703131214-23d1934099b0 or newer). 2) Until patched, disable or network-restrict the MCP endpoint and rotate any MCP credentials or tokens. 3) Remove the njs and perl modules from nginx images where not needed, and avoid running nginx as root. 4) Limit which agents can call nginx_config_add, and require human approval for configuration-write tool calls. 5) Detect: audit nginx config files and conf.d changes for js_*, perl_*, load_module and 'user root' directives, review MCP tool-call logs for nginx_config_add calls, and alert on unexpected nginx reloads or child processes spawned by nginx workers. 6) Keep configuration under version control and diff it against a known-good baseline.

Q: What systems are affected by CVE-2026-84317?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, LLM gateways and reverse proxies, model serving.

Q: What is the CVSS score for CVE-2026-84317?

CVE-2026-84317 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.48%.

GHSA-76pm-mq2q-9gcrHIGHPoC AVAILABLECISA: ATTEND

Published October 12, 2026

CISO Take

Nginx UI's MCP tool nginx_config_add writes caller-supplied nginx configuration straight to disk and reloads nginx without running the ValidateConfigFile check that the other three config-write paths enforce. An authenticated MCP caller, or an AI agent steered by prompt injection, can therefore inject njs (js_*), perl_* or load_module directives and reach code execution on the nginx host. This matters for CISOs because the flaw is network-reachable, low complexity, needs no user interaction and scores CVSS 8.8, and the official Docker image ships with the njs/perl modules available. Exploitation likelihood is currently modest (EPSS 0.38%, top 70%), with no public exploit, no Nuclei template and no CISA KEV listing, so this is a patch-promptly item rather than an emergency. Upgrade Nginx UI to 2.4.1 or later, and until then restrict or disable the MCP endpoint and review the privileges of any agent connected to it.

Sources:NVDGitHub AdvisoryEPSSATLAS

What is the risk?

High severity (CVSS 8.8) but low observed exploitation pressure: EPSS 0.00376 (top 70%), no public exploit, no scanner template, not in CISA KEV. Exploitation requires an authenticated MCP session (low privileges) or an agent that can be induced via prompt injection to call nginx_config_add. Impact is full confidentiality, integrity and availability compromise of the nginx process, which often sits in front of AI/ML services, so a compromise can expose proxied traffic, TLS keys and credentials. Exposure is highest where the MCP interface is reachable beyond a trusted admin network or is wired to autonomous agents. Confidence: HIGH on technical details (vendor advisory and commit), MEDIUM on real-world exposure (unknown deployment counts).

How does the attack unfold?

Initial Access

Attacker gains low-privilege MCP access or plants a prompt injection that an Nginx UI-connected agent ingests.

AML.T0051.001

Tool Invocation

The caller or agent invokes nginx_config_add, which writes content to disk without calling ValidateConfigFile.

AML.T0053

Execution

nginx reloads with injected js_*, perl_* or load_module directives, executing attacker code inside nginx.

AML.T0050

Impact

Attacker steals keys and proxied prompts and pivots into the AI/ML service network behind nginx.

AML.T0025

Initial Access

Attacker gains low-privilege MCP access or plants a prompt injection that an Nginx UI-connected agent ingests.

AML.T0051.001

Tool Invocation

The caller or agent invokes nginx_config_add, which writes content to disk without calling ValidateConfigFile.

AML.T0053

Execution

nginx reloads with injected js_*, perl_* or load_module directives, executing attacker code inside nginx.

AML.T0050

Impact

Attacker steals keys and proxied prompts and pivots into the AI/ML service network behind nginx.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
github.com/0xJacky/Nginx-UI	go	< 1.9.10-0.20260703131214-23d1934099b0	`1.9.10-0.20260703131214-23d1934099b0`

Do you use github.com/0xJacky/Nginx-UI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Nginx UI to v2.4.1 or later (the patched Go module is 1.9.10-0.20260703131214-23d1934099b0 or newer). 2) Until patched, disable or network-restrict the MCP endpoint and rotate any MCP credentials or tokens. 3) Remove the njs and perl modules from nginx images where not needed, and avoid running nginx as root. 4) Limit which agents can call nginx_config_add, and require human approval for configuration-write tool calls. 5) Detect: audit nginx config files and conf.d changes for js_*, perl_*, load_module and 'user root' directives, review MCP tool-call logs for nginx_config_add calls, and alert on unexpected nginx reloads or child processes spawned by nginx workers. 6) Keep configuration under version control and diff it against a known-good baseline.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionPrompt InjectionAuth BypassAgentPluginAPIAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and mechanisms for disengagement

OWASP LLM Top 10

LLM01-Prompt InjectionLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-84317?

Is CVE-2026-84317 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-84317, increasing the risk of exploitation.

How to fix CVE-2026-84317?

1) Upgrade Nginx UI to v2.4.1 or later (the patched Go module is 1.9.10-0.20260703131214-23d1934099b0 or newer). 2) Until patched, disable or network-restrict the MCP endpoint and rotate any MCP credentials or tokens. 3) Remove the njs and perl modules from nginx images where not needed, and avoid running nginx as root. 4) Limit which agents can call nginx_config_add, and require human approval for configuration-write tool calls. 5) Detect: audit nginx config files and conf.d changes for js_*, perl_*, load_module and 'user root' directives, review MCP tool-call logs for nginx_config_add calls, and alert on unexpected nginx reloads or child processes spawned by nginx workers. 6) Keep configuration under version control and diff it against a known-good baseline.

What systems are affected by CVE-2026-84317?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, LLM gateways and reverse proxies, model serving.

What is the CVSS score for CVE-2026-84317?

CVE-2026-84317 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serversLLM gateways and reverse proxiesmodel serving

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM06

What are the technical details?

Original Advisory

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1.

Exploitation Scenario

An attacker obtains low-privilege MCP access to an Nginx UI instance, or plants instructions in content that an operations AI agent reads (for example a ticket, log line or web page). The agent, or the attacker directly, calls nginx_config_add with a config containing a js_content or perl_set directive and a load_module line for the njs/perl module. Because this path skips ValidateConfigFile, the content is written to disk and nginx is reloaded. The injected script runs inside nginx, giving the attacker command execution on the host that fronts the organization's LLM gateway, from which they harvest API keys, TLS private keys and proxied prompts, and then move laterally.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary CWE-20Improper Input ValidationPrimary CWE-693Protection Mechanism FailurePrimary CWE-693Protection Mechanism FailurePrimary CWE-20Improper Input Validation CWE-693Protection Mechanism Failure

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.