UpHeron
All vulnerabilities

Servers and applications

CVE-2026-84319

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Severity
High 8.3
Published
12 Oct 2026
Last changed
13 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
2.4.1
Sources
CVE Program

Affected software

SoftwareAffected versions
Nginx UIServers and applications · cna:0xjacky|nginx-ui
  • Every version before 2.4.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-84319