2026-04-13 · 2026-Q2

Nginx UI MCP Auth Bypass Under Active Exploitation

Primary layerL6 Identity / RunSecondary:L5 Config

Which agent, run, or tenant is this?
The question layer 6 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: Yes
Actor: Attacker

Target

nginx-ui open-source Nginx management tool (before v2.3.4), approximately 2,600 publicly reachable instances

Impact

Network-adjacent attacker can invoke 12 MCP tools (including nginx_config_add with auto-reload) in two HTTP requests; full Nginx server takeover, traffic interception, administrator credential harvest; chains with CVE-2026-27944 to extract the node_secret for ongoing session control

Root cause

/mcp_message endpoint handles every destructive tool invocation without the AuthRequired() middleware that protects the paired /mcp endpoint

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Nginx UI MCP Auth Bypass Under Active Exploitation (2026-04-13). https://agentprov.com/incidents/2026-04-13-nginx-ui-mcp-auth-bypass-under-active-exploitation

Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run