Is CVE-2026-84360 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84360?

CVE-2026-84360 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-84360

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.