Nginx UI is a web user interface for the Nginx web server.
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- F5
- Product
- NGINX
- CVSS
- 8.1
- EPSS
- 0.004 (p36)
- Fix
- available
- Exposure class
- Web platform
Why it ranks 20 (Routine)
- CVSS 8.1 high
- Product class: web platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-84360 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.