Nginx-Ui

Multiple vulnerabilities in nginx-ui allow an attacker to execute arbitrary code, including with root privileges, gain elevated privileges, perform account takeover, bypass security measures, and disclose or manipulate data.

Nginx-UI is vulnerable to unauthenticated remote takeover due to a missing authentication check on the `/mcp_message` endpoint, allowing attackers to invoke MCP tools without authentication, leading to arbitrary nginx configuration modification, traffic interception, service disruption, configuration exfiltration, and credential harvesting; the default empty IP whitelist allows access from any network attacker.

The nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration, potentially leading to arbitrary command execution.