2026-04-13 · 2026-Q2
Nginx UI MCP Auth Bypass Under Active Exploitation
PrimaryL6Identity / RunSecondaryL5Config
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- Yes
- Actor:
- Attacker
Target
nginx-ui open-source Nginx management tool (before v2.3.4), approximately 2,600 publicly reachable instances
Impact
Network-adjacent attacker can invoke 12 MCP tools (including nginx_config_add with auto-reload) in two HTTP requests; full Nginx server takeover, traffic interception, administrator credential harvest; chains with CVE-2026-27944 to extract the node_secret for ongoing session control
Root Cause
/mcp_message endpoint handles every destructive tool invocation without the AuthRequired() middleware that protects the paired /mcp endpoint