Nginx UI EUVD-2026-97895

Requires an authenticated caller able to reach the MCP tool nginx_config_add (mcp/config/config_add.go), or an MCP-enabled AI agent whose inputs an attacker can poison via prompt injection. For the injected directives to achieve code execution, the nginx build must have the njs or perl module available - true for the official Docker image but not all installations. The other three config-write paths (api/config/add.go, api/config/modify.go, mcp/config/config_modify.go) are NOT exploitable because they enforce ValidateConfigFile. Limiting factors: valid MCP authentication/authorization (PR:L), and absence of the njs/perl module neutralizes code execution even though the directive injection still succeeds. Affects versions prior to 2.4.1 only.

This is a credible, actionable priority rather than a paper-high CVSS. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw that yields full CIA impact - consistent with the described outcome of arbitrary nginx code execution. PR:L correctly reflects that an authenticated MCP caller is required, so this is not unauthenticated RCE. The key amplifier is the prompt-injection vector: because the vulnerable path is an MCP tool (nginx_config_add), an attacker who can influence an AI agent's inputs may trigger it without holding credentials directly, which is a realistic modern exploitation path. Exploitation is conditional on the njs/perl module being present (true on the official Docker image), so impact is deployment-dependent. No EPSS score, no CISA KEV listing, and no public POC were provided - so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reading: technical impact is total, automatable is plausible given the simple API call, but exploitation is not confirmed active. The root cause is well-understood (an inconsistent security control applied to three of four write paths), which lowers analytic uncertainty. Note the provided commit diff shows backup-router / RequireSecureSession changes rather than the config_add.go fix described - verify the exact remediation commit against the GHSA advisory.

An attacker with authenticated access to the Nginx UI MCP interface - or who can prompt-inject an AI agent that wields the MCP tools - calls nginx_config_add with configuration content containing a blocked directive such as load_module of the njs module plus a js_* handler. Because this single path skips ValidateConfigFile, the content is written to disk and nginx is reloaded, executing attacker-controlled module code on deployments where njs/perl is available (e.g., the official Docker image). No public exploit was identified at time of analysis, though the root cause is fully documented in the advisory.