Topic

NGINX

Reporting and analysis related to NGINX.

Articles: 1
Desk: 1

Data graphic: Nginx UI's REST API and MCP tool compared on writing nginx config CVSS 8.8 High, CVE-2026-84318 and CVE-2026-84317 . The REST path checks the directive denylist and requires the OTP step-up, so it rejects the config. The MCP tool nginx_config_add skips both checks, and the config is written and reloaded. An attacker needs a valid login with MCP enabled; the fix is in Nginx UI 2.4.1.

highAI Security NGINX

Nginx UI's MCP tools skipped the config checks its web UI enforces, handing logged-in users nginx code execution

Four CVEs show Nginx UI's MCP tool wrote nginx config without the validation and OTP step-up its REST API applies. Fixed in 2.4.1; upgrade to the current release.

Oct 18 · 4 min