Tools AI Risk Radar ai-incident-0236
Incident record
Nginx UI MCP tools bypassed additional authentication
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- Nginx UI MCP configuration tools
- Actor
- researcher
- CVE
- CVE-2026-84360
What happened
An already authenticated user could change Nginx configuration through MCP without completing the additional OTP step required by the HTTP configuration interface.
The maintainer advisory describes an isolated local test and distinguishes ordinary authentication from the secure-session requirement. GitHub’s reviewed record lists the fixed version as 1.9.10-0.20260703131214-23d1934099b0. The maintainer published the advisory on 17 July; GitHub added its reviewed record on 15 October.
Sources
- Maintainer security advisorygithub.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4g…
- GitHub reviewed advisorygithub.com/advisories/GHSA-vc32-4gwf-77xp
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026