Nginx UI: Multiple MCP vulnerabilities bypass security controls

Three authenticated vulnerabilities in Nginx UI's MCP interface allow secondary users to bypass directive validation, execute arbitrary code via NJS in Nginx worker context, and circumvent OTP secure-session step-up requirements. The MCP configuration tools lack the same validation checks present in the HTTP API.

Disclosed 15 October 2026 · Record updated 15 October 2026

Impact

Authenticated attackers can bypass security controls to write restricted Nginx directives, execute arbitrary NJS code in Nginx worker context, and modify configuration without OTP step-up authentication. This allows modification of Nginx runtime behavior including responses, routing, headers, and request handling.

Our coverage

A locked safe door swings open as a second key holder bypasses the vault's security gates, reaching past the guardian's checkpoint into restricted chambers.

Vulnerabilities

Nginx UI flaws let MCP tools skip config security checks

Three authenticated vulnerabilities disclosed on 15 October 2026 let secondary users bypass directive validation and OTP step-up through Nginx UI's MCP interface.

15 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-5r62-gj48-897x
github.comhttps://github.com/advisories/GHSA-9jww-cxg5-rj9m
github.comhttps://github.com/advisories/GHSA-vc32-4gwf-77xp