CVE-2026-33032

Nginx UI versions 2.3.5 and prior ship a Model Context Protocol (MCP) integration exposed via two HTTP endpoints, /mcp and /mcp_message; while /mcp requires authentication, /mcp_message enforces only IP whitelisting, and the default whitelist is empty, which the middleware treats as allow-all, so the endpoint accepts requests with no authentication (CWE-306, missing authentication for a critical function). An attacker with network reachability to /mcp_message can invoke all MCP tools unauthenticated, including restarting nginx, creating, modifying, or deleting nginx configuration files, and triggering automatic config reloads. This yields complete takeover of the nginx service on the affected host, with critical-severity impact across confidentiality, integrity, and availability (CVSS 3.1: 9.8). All Nginx UI deployments running 2.3.5 or earlier are affected, especially those where the MCP endpoints are reachable from untrusted networks. News reports indicate the flaw is being actively exploited in the wild; it is not yet in CISA KEV, EPSS is high at 36.3% (98th percentile), and no patched release was available at publication.

What to do: No fixed release was available at publication — monitor the upstream advisory (GHSA-h6c2-x2m2-mwhf) and the Nginx UI project and upgrade as soon as a patched version ships. Until then, restrict exposure of /mcp_message by setting a non-empty IP whitelist, firewalling the MCP endpoints to trusted management addresses or localhost/VPN only, or disabling the MCP integration. Review access logs for unauthenticated requests to /mcp_message and check for unexpected nginx config changes or restarts, which would indicate exploitation.