Description
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 0xJacky | nginx-ui | < 2.4.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 | GHSA-vc32-4gwf-77xp |
Advisories 1
- WID-SEC-2026-2390 nginx-ui: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2026