Skip to content
OpenAdvisories
High WID-SEC-2026-2390 11 CVEs

nginx-ui: Mehrere Schwachstellen

Published Jul 16, 2026 · Updated Oct 12, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um beliebigen Code auszuführen, einschließlich der Codeausführung mit Root-Rechten; erweiterte Rechte zu erlangen; eine Kontoübernahme durchzuführen; Sicherheitsmaßnahmen zu umgehen; oder Daten offenzulegen und zu manipulieren.

Product

nginx-ui ist eine Open-Source-Weboberfläche zur Verwaltung und Konfiguration von Nginx-Webservern.

Vulnerabilities 11

  • High 8.8
    CVE-2026-84313

    Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password.…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.8
    CVE-2026-84316

    Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.8
    CVE-2026-84317

    Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It i…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.8
    CVE-2026-84318

    Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the RE…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.7
    CVE-2026-84314

    Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service pass…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.3
    CVE-2026-84315

    Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive a…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.3
    CVE-2026-84319

    Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authe…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 8.1
    CVE-2026-84360

    Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_mo…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 7.1
    CVE-2026-84312

    Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Medium 6.3
    CVE-2026-84320

    Nginx UI: Auto backup name allows path traversal outside validated storage path

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downs…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Medium 5.4
    CVE-2026-84321

    Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revo…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-84314, EUVD-2026-97862, CVE-2026-84316, EUVD-2026-97906, CVE-2026-84321, EUVD-2026-97864, CVE-2026-84315, EUVD-2026-97830, CVE-2026-84320, EUVD-2026-97860, CVE-2026-84319, EUVD-2026-97905, CVE-2026-84313, EUVD-2026-97865, CVE-2026-84317, EUVD-2026-97895, CVE-2026-84360, EUVD-2026-97907, CVE-2026-84312, EUVD-2026-97963, CVE-2026-84318, EUVD-2026-97908

  2. #1

    Initiale Fassung

References