CVE-2026-84319

{
  "etk_id": "ETK-2026-1722",
  "cve_id": "CVE-2026-84319",
  "display_id": "CVE-2026-84319",
  "ghsa_id": "GHSA-5r62-gj48-897x",
  "euvd_id": "EUVD-2026-97905",
  "status": "published",
  "anchor_state": "anchored",
  "title": "MCP configuration validation bypass in Nginx UI",
  "summary": "Nginx UI's MCP configuration interface does not enforce the directive restrictions applied by its regular HTTP configuration API. A secondary authenticated user can apply restricted configuration that causes attacker-controlled NJS to run in Nginx worker processes, potentially changing request handling, routing, headers, redirects, or responses. MCP must be enabled and NJS must be available in the Nginx installation.",
  "mitigation": "Upgrade go github.com/0xJacky/Nginx-UI to 1.9.10-0.20260703131214-23d1934099b0 or later. Until upgraded, disable MCP or prevent secondary accounts from accessing it.",
  "vendor": "go",
  "product": "go:github.com/0xJacky/Nginx-UI",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.9.10-0.20260703131214-23d1934099b0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.9.10-0.20260703131214-23d1934099b0"
      ],
      "package_name": "github.com/0xJacky/Nginx-UI",
      "purl": "pkg:golang/github.com/0xJacky/Nginx-UI"
    }
  ],
  "cwes": null,
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
  "epss_score": 0.0028,
  "epss_percentile": 0.1924,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.42010245,
  "t0_at": "2026-10-12T21:03:36.112000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-15T20:10:44+00:00",
      "days": 2.9632857407407407,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T21:03:36.112000+00:00",
      "url": "https://github.com/advisories/GHSA-5r62-gj48-897x"
    },
    "trigger_signal": {
      "at": "2026-10-12T21:03:36.112000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T21:03:36.112000+00:00",
      "url": "https://github.com/advisories/GHSA-5r62-gj48-897x"
    }
  }
}