# Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Nginx UI's MCP config tools skipped restricted-directive validation, letting a secondary authenticated user load NJS and execute code in the Nginx worker.

- Payout: Research
- Severity: high
- Program: Nginx UI
- Found by: aleff-github
- Disclosed: 2026-10-15
- CVE: CVE-2026-84319
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-5r62-gj48-897x
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x
- Tags: area:ai domain:ai domain:web impact:integrity impact:rce kind:research platform:ghsa sev:high tech:nginx technique:incomplete-fix vuln:access-control vuln:misconfiguration vuln:rce

**Target:** MCP configuration interface (/mcp, /mcp_message) and nginx_config_add tool
**Root cause:** The MCP configuration write path (nginx_config_add) does not call ValidateConfigFile, so restricted directives (load_module, js_import, js_content) blocked by the HTTP /api/configs API are accepted and applied.
**Steps:**
1. Confirm NJS module present: `find / -name "ngx_http_js_module.so"`
2. Show HTTP API rejects restricted content: `POST /api/configs` with `load_module`/`js_import`/`js_content` returns rejection
3. Open MCP session, call `tools/call` `nginx_config_add` writing `poc.js` with `function handler(r) { r.return(200, "MCP_NJS_MARKER\n"); }`
4. Call `nginx_config_add` again writing nginx.conf containing `load_module modules/ngx_http_js_module.so;`, `js_import poc from /etc/nginx/poc.js;`, `location /__poc { js_content poc.handler; }`
5. Reload Nginx and `curl -i http://127.0.0.1:18249/__poc` returns `MCP_NJS_MARKER`
**How found:** Compared the HTTP config API's restricted-directive validation against the MCP config tool path and noticed the MCP path lacked the same check, then tested writing equivalent restricted content via MCP.
**Exploitation:** Secondary authenticated user uses MCP nginx_config_add to write an attacker JS file and an nginx.conf loading ngx_http_js_module.so with js_import/js_content, reloads Nginx, and executes NJS in the worker context, controlling responses, routing, headers and redirects.
**Insight:** When a product exposes the same privileged operation over multiple interfaces (HTTP API vs MCP/agent tools), diff the validation each path applies; newer agent-facing tool surfaces often skip checks enforced on the legacy API.