Authentication bypass using an alternate path or channel in nginx-ui - #VU157116
Published: October 22, 2026
Vulnerability identifier: #VU157116
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-288
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass HTTP MCP authentication, disclose sensitive configuration information, and potentially modify nginx configuration through management tools.
The vulnerability exists due to improper authentication in the mcpAuthRequired() middleware in mcp/router.go when handling HTTP requests to POST /mcp and POST /mcp_message. A remote user can submit a valid 16-character WebSocket short token as an Authorization: Bearer credential to invoke MCP management tools outside the token's intended WebSocket scope.
Affected software
nginx-ui
Remediation
Install security update from vendor's website.
nginx-ui - update to 2.9.0