Is CVE-2026-84319 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84319 being exploited in the wild.

How severe is CVE-2026-84319?

High severity, with a CVSS score of 8.3, published 12 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0.

How is CVE-2026-84319 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84319?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84319: Nginx UI MCP configuration directive validation bypass

Q: Is there a fix for CVE-2026-84319?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Until then: Disable the MCP interface if it is not required, or restrict MCP access to trusted administrators only. Apply the patch that extends directive validation to MCP configuration tools, ensuring the same checks used by the HTTP API are applied before configuration writes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84319 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-84319?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84319 · Severity: high · CVSS 8.3 · Published 2026-10-12

Nginx UI is a web interface for managing Nginx web server configurations. A secondary authenticated user can use the MCP (Model Context Protocol) configuration interface to bypass security controls that normally block dangerous Nginx directives, then execute arbitrary JavaScript code within Nginx worker processes. This allows an attacker with a low-privilege account to modify how the web server processes requests and responses.

Technologies: github.com/0xJacky/Nginx-UI (Go). Vendors: Go, NGINX.

Quick answers

Is CVE-2026-84319 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84319 being exploited in the wild.
How severe is CVE-2026-84319?: High severity, with a CVSS score of 8.3, published 12 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0.
Is there a fix for CVE-2026-84319?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Until then: Disable the MCP interface if it is not required, or restrict MCP access to trusted administrators only. Apply the patch that extends directive validation to MCP configuration tools, ensuring the same checks used by the HTTP API are applied before configuration writes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84319 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84319?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0
```

Disable the MCP interface if it is not required, or restrict MCP access to trusted administrators only. Apply the patch that extends directive validation to MCP configuration tools, ensuring the same checks used by the HTTP API are applied before configuration writes.

Technical details

The HTTP API enforces validation against restricted Nginx directives (load_module, js_import, js_content, js_set, perl_set, user root), but the MCP configuration tools lack equivalent checks. An authenticated attacker can use the nginx_config_add MCP tool to write files and apply configuration containing these restricted directives, then reload Nginx to execute attacker-controlled NJS (Nginx JavaScript) in the worker context. The vulnerability requires secondary authentication and MCP to be enabled, but allows runtime code execution in a critical process.

Affected products

Nginx Nginx UI

Identifiers

CVE-2026-84319
GHSA-5r62-gj48-897x
GO-2026-6774

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.