CVE-2026-84316

{
  "etk_id": "ETK-2026-1748",
  "cve_id": "CVE-2026-84316",
  "display_id": "CVE-2026-84316",
  "ghsa_id": "GHSA-cf23-7qxj-xmhr",
  "euvd_id": "EUVD-2026-97906",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Nginx UI configuration directive validation bypass",
  "summary": "Nginx UI's configuration validation can fail to detect restricted directives when processing configuration changes. An authenticated user able to write Nginx configuration can change server behavior and may execute code in the Nginx worker context if executable modules are available. Access to a node secret or authenticated user account is required.",
  "mitigation": "Upgrade go:github.com/0xJacky/Nginx-UI to 1.9.10-0.20260703131214-23d1934099b0 or later. Until then, limit configuration-write access and remove or disable executable Nginx modules where practical.",
  "vendor": "go",
  "product": "go:github.com/0xJacky/Nginx-UI",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.9.10-0.20260703131214-23d1934099b0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.9.10-0.20260703131214-23d1934099b0"
      ],
      "package_name": "github.com/0xJacky/Nginx-UI",
      "purl": "pkg:golang/github.com/0xJacky/Nginx-UI"
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.004,
  "epss_percentile": 0.3269,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.531691783333333,
  "t0_at": "2026-10-12T21:05:06.173000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-15T20:13:52+00:00",
      "days": 2.9644192939814813,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T21:05:06.173000+00:00",
      "url": "https://github.com/advisories/GHSA-cf23-7qxj-xmhr"
    },
    "trigger_signal": {
      "at": "2026-10-12T21:05:06.173000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T21:05:06.173000+00:00",
      "url": "https://github.com/advisories/GHSA-cf23-7qxj-xmhr"
    }
  }
}