Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

Summary

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.

Timeline

1. Mar 30, 2026, 5:58 PM UTCCVE published
2. Mar 30, 2026, 6:37 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: total

3. Apr 16, 2026, 9:42 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• 0xJacky nginx-ui

  through 2.3.5

• github.com/0xJacky/Nginx-UIGo

  All versions

• github.com/0xJacky/Nginx-UIGo

  through 1.99

References 6