PkgSeer

Vulnerability GO-2026-6779

Unknown

5 hours ago

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9

Summary

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI

Details

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6773

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6786

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6771

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6774

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI

v1.1.0 - v1.9.9 GO-2026-6775

View all vulnerabilities for these packages

Impacted packages

github.com/0xJacky/Nginx-UI

Timeline

Published

5 hours ago

Fixed (v1.9.10-0.20260703131214-23d1934099b0)

3 months ago

Last Modified

4 hours ago