CVE-2026-84360: Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

October 15, 2026

An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcp_message using only ordinary authentication.

References

github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp
github.com/advisories/GHSA-vc32-4gwf-77xp
nvd.nist.gov/vuln/detail/CVE-2026-84360

Code Behaviors & Features

Detect and mitigate CVE-2026-84360 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →