Nginx UI EUVD-2026-97908

Exploitation requires (1) an authenticated Nginx-UI session at minimum a low-privilege user (CVSS PR:L), and (2) use of the MCP tool nginx_config_add rather than the REST endpoint POST /api/configs - the REST path calls config.ValidateConfigFile and correctly rejects dangerous directives, so only the MCP flow is vulnerable. The arbitrary-config-write and nginx-reload primitive works against any affected version (2.0.0-rc.6 through 2.4.0) regardless of modules. The full Remote Code Execution outcome additionally requires the target nginx to have the Perl, njs, or Lua module loaded so that injected directives such as perl, js_import, or load_module actually execute code. Limiting factors for defenders: valid authentication is mandatory (not internet-anonymous), the MCP interface must be reachable/enabled, and without a scripting module loaded the impact is config tampering rather than direct code execution.

This is a genuine priority within its (limited) deployment footprint rather than a high-CVSS paper tiger. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring only low privileges (PR:L = authenticated), scoring 8.8. The signals are internally consistent: the description confirms the flaw is post-authentication, matching PR:L, and the attack is a straightforward API request, matching AC:L. However, the top-end impact (full RCE, hence C:H/I:H/A:H) is CONDITIONAL - the description explicitly states RCE only materializes 'on a server with the nginx Perl, njs, or Lua module loaded.' Without such a module, the attacker still achieves an arbitrary nginx-config write (a serious integrity/availability issue and a likely stepping stone), but not immediate code execution, so the real-world worst case depends on target configuration. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input; the fix commit and a security advisory exist but a weaponized PoC is not referenced. CWE-693 (Protection Mechanism Failure) accurately frames the root cause: the MCP code path omits config.ValidateConfigFile that the REST path enforces. Net assessment: elevated risk for exposed Nginx-UI instances where any attacker can obtain a low-privilege authenticated session, tempered by the authentication requirement and the module-loaded precondition for the RCE outcome. No SSVC decision data was supplied in the input.

An attacker who has obtained any authenticated Nginx-UI session (low-privilege account) invokes the MCP tool nginx_config_add to write an nginx configuration containing a normally-blocked directive such as load_module, perl, or js_import, which the MCP path fails to validate before reloading nginx. If the server has the Perl, njs, or Lua module available, the injected directive executes attacker-controlled code with nginx's privileges, yielding post-authentication remote code execution. No public exploit is referenced in the input, so exploitation would rely on attacker-developed tooling against the documented MCP flow.