The vulnerability is present in Nginx UI version 2.3.5 and earlier. The MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While the /mcp endpoint is protected by authentication, the /mcp_message endpoint only applies IP whitelisting, and by default that whitelist is empty, effectively allowing all IP addresses. This allows any network attacker who can reach the application to invoke all MCP tools, including commands to restart Nginx, create or modify nginx configuration files, and trigger automatic configuration reloads, resulting in a complete takeover of the Nginx service. The weakness is characterized as CWE‑306 (Missing Authentication) and leads to a critical remote code execution that compromises confidentiality, integrity, and availability of the web server.

Affected deployments are those using the Nginx UI web interface released by 0xJacky. Versions 2.3.5 and earlier are impacted. The vulnerability manifests when the default empty IP whitelist remains in force, so any environment that exposes the Nginx UI to external networks may be exposed.

The CVSS base score is 9.8, indicating a critical severity. The EPSS score of 13% indicates a relatively low but non‑zero potential for exploitation; nevertheless, the absence of authentication means that an attacker only needs network reachability to the /mcp_message endpoint. The vulnerability is not yet listed in the CISA KEV catalog, but the ability to take over the Nginx service warrants immediate consideration. Attacks are possible from any remote host that can contact the web interface; no additional authentication or privilege escalation is required beyond connectivity.