Tools AI Risk Radar ai-incident-0238
Incident record
Nginx UI MCP add tool skipped configuration validation
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- Nginx UI MCP nginx_config_add
- Actor
- researcher
- CVE
- CVE-2026-84318
What happened
An authenticated MCP caller could write restricted Nginx configuration and reload the server through a tool that skipped the validation used by the HTTP path.
Code execution depends on the available Nginx scripting modules. Related disclosures CVE-2026-84317 and CVE-2026-84319 describe this same configuration-add boundary, so they are grouped here. GitHub’s reviewed records list the fixed version 1.9.10-0.20260703131214-23d1934099b0. The maintainer published the advisories on 17 July; GitHub added the reviewed records on 15 October.
Sources
- Maintainer security advisorygithub.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cx…
- GitHub reviewed advisorygithub.com/advisories/GHSA-9jww-cxg5-rj9m
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026