Key points
- The flaw affects Nginx-UI versions prior to 1.9.10-0.20260703131214-23d1934099b0.
- Attackers can bypass checks by placing benign directives before blocked ones on the same line.
- A patched version is available, but only for the specific build mentioned above.
Users of the Nginx-UI management interface must update to version 1.9.10-0.20260703131214-23d1934099b0 or later. This release addresses a high-severity vulnerability, identified as CVE-2026-84316, that allows authenticated callers to bypass security controls. The flaw exists in the configuration validation logic used across multiple API endpoints and tools within the application.
In plain English
The application attempts to block dangerous Nginx directives, such as those that load modules or run as root. However, its scanner only checks the first word on each line of the configuration file. Nginx allows multiple directives on a single line separated by semicolons. By placing a safe directive first and a blocked one after a semicolon, users can defeat every check.
The background
This issue impacts the `config.ValidateConfigFile` function, which is supposed to block directives like `js_`, `perl_`, `load_module`, and `user root`. The scanner splits configuration content by newlines and inspects only the initial token. It fails to detect blocked directives that appear later on the same line. The `include` directive is also missing from the denylist entirely.
What changes now
The vulnerability affects every path that calls the validator, including adding configs via `POST /api/configs`, modifying configurations through the REST API, and saving sites or streams. It also impacts the `nginx_config_modify` tool in the MCP interface. This is distinct from a separate gap where the `nginx_config_add` tool did not call the validator at all.
Who needs to act first
Teams usually prioritize systems exposed to the internet or accessible by untrusted users. Check whether your deployment includes Nginx modules like njs or perl, as these increase the risk of code execution. Test the update in a non-production environment first to ensure stability. Back up existing configurations before applying changes. If you cannot patch immediately, restrict access to the management interface to trusted networks only. Monitor logs for unusual configuration changes or attempts to load restricted modules.
What to do and how to stay safe: Nginx-UI
- Verify your current Nginx-UI version and compare it against the patched release number.
- Review configuration files for any lines containing multiple directives separated by semicolons.
- Restrict network access to the management interface to limit exposure while waiting for updates.
- Once the vendor provides an update, apply it to all affected instances and verify the fix works.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of Nginx-UI are vulnerable?
All versions prior to 1.9.10-0.20260703131214-23d1934099b0 are affected by this vulnerability.
Can an attacker execute code through this flaw?
Yes, if the Nginx deployment includes the njs or perl modules, this can lead to code execution in the worker process.
Is there a fix available for this issue?
Yes, a patched version (1.9.10-0.20260703131214-23d1934099b0) is available and resolves the validation bypass.
