GHSA-vc32-4gwf-77xp CVE-2026-84360 GO-2026-6799

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

High Go

Severity: 8.1 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.42%; Chance of exploitation in the next 30 days. Higher than 36.35% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Fix: 1.9.10-0.20260703131214-23d1934099b0; Upgrade github.com/0xJacky/Nginx-UI to this version or later

Description

Summary

An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcp_message using only ordinary authentication.

Details

The HTTP configuration mutation surface is explicitly grouped behind middleware.RequireSecureSession(). By contrast, the MCP endpoints are exposed with only middleware.AuthRequired(). The MCP server exposes configuration mutation tools including nginx_config_add and nginx_config_modify, so OTP-enabled users gain an alternate path around the intended step-up requirement.

Relevant code paths:

api/config/router.go
internal/middleware/secure_session.go
mcp/router.go
mcp/config/config_add.go
mcp/config/config_modify.go

This is a security-control bypass rather than a missing feature. The product already established that OTP-enabled users should complete a secure session before high-impact configuration mutations are accepted on the HTTP path.

PoC

I verified this locally in an isolated environment with a temporary end-to-end harness that exercised the real /mcp and /mcp_message routes.

What the executed test did:

Created a temporary config directory and configured Nginx control commands to harmless local values (true) to avoid touching the host.
Created a real OTP-enabled user in a temporary SQLite database.
Generated a real JWT for that OTP-enabled user.
Started a local test server exposing the real /mcp and /mcp_message routes.
Opened an authenticated SSE connection to /mcp with the JWT and no X-Secure-Session-ID.
Initialized the MCP session over /mcp_message.
Called the real nginx_config_add tool over /mcp_message.
Verified that the tool succeeded and created mcp-bypass.conf in the managed config directory without any secure-session step-up.

Observed result from the actual local verification:

The MCP session initialized successfully without any X-Secure-Session-ID.
The config file was written through the MCP tool path using only JWT authentication.

Impact

OTP-enabled accounts lose the intended step-up protection for high-impact Nginx configuration changes when MCP is enabled. A user who should be blocked until re-authenticating can still create or modify configuration files and trigger reload behavior through MCP.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/0xJacky/Nginx-UI	`< 1.9.10-0.20260703131214-23d1934099b0`	`1.9.10-0.20260703131214-23d1934099b0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/0xJacky/Nginx-UI Go → `1.9.10-0.20260703131214-23d1934099b0`

go

go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0 && go mod tidy

Severity breakdown

CVSS 3.1 8.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

Weakness

CWE-288: Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How to prevent it

Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-84360

Packages

github.com/0xJacky/nginx-ui

Timeline

Oct 12, 2026 Published
Oct 19, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GO-2026-6773 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)	High	Also affects github.com/0xJacky/Nginx-UI
GHSA-wq4w-vwvq-q3x9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable	Medium	Also affects github.com/0xJacky/Nginx-UI
GHSA-jrq7-xrjx-pcfw Nginx UI: Auto backup name allows path traversal outside validated storage path	Medium	Also affects github.com/0xJacky/Nginx-UI
GHSA-5r62-gj48-897x Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context	High	Also affects github.com/0xJacky/Nginx-UI
GHSA-9jww-cxg5-rj9m Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE	High	Also affects github.com/0xJacky/Nginx-UI
GHSA-76pm-mq2q-9gcr Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)	High	Also affects github.com/0xJacky/Nginx-UI
GHSA-cf23-7qxj-xmhr Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)	High	Also affects github.com/0xJacky/Nginx-UI
GHSA-5v7c-xpfp-p65m Nginx UI OTP secure-session step-up is missing on sensitive mutation routes	High	Also affects github.com/0xJacky/Nginx-UI

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor