Tools AI Risk Radar ai-incident-0237
Incident record
Nginx UI configuration checks missed chained directives
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- Nginx UI configuration validator and MCP tools
- Actor
- researcher
- CVE
- CVE-2026-84316
What happened
An authenticated caller could place a restricted directive after an allowed directive on the same line and bypass the configuration scanner.
The affected paths include MCP configuration modification and HTTP configuration tools. With the relevant Nginx modules available, the advisory describes code execution in a worker. GitHub’s reviewed record lists the fixed version as 1.9.10-0.20260703131214-23d1934099b0; the maintainer published the advisory on 17 July and GitHub added its reviewed record on 15 October.
Sources
- Maintainer security advisorygithub.com/0xJacky/nginx-ui/security/advisories/GHSA-cf23-7q…
- GitHub reviewed advisorygithub.com/advisories/GHSA-cf23-7qxj-xmhr
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026