Nginx UI CVE-2026-84360

Requires an authenticated, OTP-enabled Nginx UI account and a valid ordinary JWT; the attacker does NOT need the X-Secure-Session-ID step-up header that normally gates HTTP config mutation. Exploitation is performed specifically through the /mcp or /mcp_message MCP endpoints, which exposed nginx_config_add and nginx_config_modify behind ordinary authentication only. Limiting factors: the attacker must already possess valid low-privilege credentials or a stolen/forged JWT (PR:L), the account must be OTP-enabled, and the instance must run a version prior to 2.4.1; there is no unauthenticated or no-interaction path, which meaningfully constrains external attackers.

This is a genuine high-priority issue for anyone running Nginx UI below 2.4.1, but the real-world risk is materially lower than the 8.1 CVSS might suggest because exploitation requires an existing authenticated foothold. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) correctly captures a network-reachable, low-complexity, authenticated flaw with no confidentiality impact but high integrity and availability impact - consistent with CWE-288 (authentication bypass via an alternate path). The core weakness is an authorization inconsistency: the intended step-up control (RequireSecureSession / X-Secure-Session-ID) gates the normal HTTP config-mutation routes, but the /mcp and /mcp_message routes expose the same nginx_config_add and nginx_config_modify capabilities behind ordinary JWT auth only, so an OTP-enabled user who should be forced through step-up can skip it. No EPSS score, no CISA KEV listing, and no public PoC were provided, so there is no evidence of widespread or automated exploitation - the realistic threat is an insider, a compromised low-privilege account, or a stolen/forged normal JWT rather than an unauthenticated internet-wide attack. Weighing the signals together: high technical impact and low attack complexity raise priority, but the PR:L authentication requirement and absence of KEV/EPSS/POC signals keep this in the 'patch promptly, not a drop-everything emergency' tier for most deployments.

An attacker who holds (or steals) a valid normal JWT for an OTP-enabled Nginx UI account sends a request to the /mcp or /mcp_message endpoint, which checks only ordinary authentication and not the X-Secure-Session-ID step-up header. Through MCP they invoke nginx_config_add or nginx_config_modify to inject a malicious server/location block and trigger a reload, altering how Nginx serves or proxies traffic. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means once a JWT is obtained the request is straightforward.