Nginx UI CVE-2026-84316

Requires an authenticated Nginx UI session with permission to write configuration through the REST, nginx_config_modify, site, or stream write paths on a version prior to 2.4.1. The attacker crafts a single configuration line containing a benign directive followed by a semicolon-separated restricted directive (load_module, js_import, perl, or user root) - or an unrestricted include that pulls in restricted content - exploiting that ValidateConfigDirectives only checks the first token per newline-split line. The strongest outcome, arbitrary code execution in the Nginx worker, is LIMITED by the requirement that an executable/loadable Nginx module (.so) already be present on the host for the injected load_module directive to run. Limiting factors for defenders: valid authenticated credentials with config-write privilege are mandatory (not exploitable pre-auth), and the instance must be running a version before 2.4.1.

This is a genuine high-priority issue for anyone exposing Nginx UI, but the risk is gated by authentication. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity flaw requiring only low privileges (PR:L) - i.e. any authenticated caller with config-write access, not an anonymous attacker. The impact triad is uniformly High because a successful bypass leads to code execution in the Nginx worker context, effectively full compromise of the host's web-serving process. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis; the exploitation-probability and active-exploitation signals are simply ABSENT, not low - do not read their absence as safety. The practical risk is tempered by two factors the raw score does not capture: (1) an attacker must first hold valid authenticated credentials with config-write permission, and (2) the strongest outcome - arbitrary code execution via load_module - additionally requires an executable Nginx module (.so) to already be present on the system. The CVSS vector and the description are consistent (both point to an authenticated remote actor), so there is no AV/PR conflict to flag. Net: a real, patch-now vulnerability for exposed instances, but it is an authenticated post-access escalation rather than a wormable unauthenticated RCE.

An authenticated Nginx UI user with config-write access submits a configuration through a REST, nginx_config_modify, site, or stream write path, placing a harmless directive first on a line followed by a semicolon and a restricted directive such as load_module, perl, js_import, or user root - the validator only inspects the first token, so the restricted directive slips through. When a loadable Nginx module is available, the injected load_module directive causes code execution in the Nginx worker process; alternatively an unrestricted include directive pulls in attacker-controlled restricted content. No public exploit was identified at time of analysis, though the mechanism is fully documented in the vendor advisory and fix commit.