Infosecurity Magazinepublished Apr 15, 13:00 UTC (Apr 15, 2026)ingested Sep 10, 06:11 UTCAlessandro Mascellino

Critical Nginx-ui MCP Flaw Actively Exploited in the Wild

criticalExploit / PoC exploited in the wildimportance 60CVE-2026-33032

Read the original

Tagscve-2026-33032 exploit

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-33032	Unauthenticated MCP Endpoint Access in Nginx UI Enables Full Nginx Server Takeover Nginx UI versions 2.3.5 and prior ship a Model Context Protocol (MCP) integration exposed via two HTTP endpoints, /mcp and /mcp_message; while /mcp requires authentication, /mcp_message enforces only IP whitelisting, and the default whitelist is empty, which the middleware treats as allow-all, so the endpoint accepts requests with no authentication (CWE-306, missing authentication for a critical function). An attacker with network reachability to /mcp_message can invoke all MCP tools unauthenticated, including restarting nginx, creating, modifying, or deleting nginx configuration files, and triggering automatic config reloads. This yields complete takeover of the nginx service on the affected host, with critical-severity impact across confidentiality, integrity, and availability (CVSS 3.1: 9.8). All Nginx UI deployments running 2.3.5 or earlier are affected, especially those where the MCP endpoints are reachable from untrusted networks. News reports indicate the flaw is being actively exploited in the wild; it is not yet in CISA KEV, EPSS is high at 36.3% (98th percentile), and no patched release was available at publication. Do: No fixed release was available at publication — monitor the upstream advisory (GHSA-h6c2-x2m2-mwhf) and the Nginx UI project and upgrade as soon as a patched version ships. Until then, restrict exposure of /mcp_message by setting a non-empty IP whitelist, firewalling the MCP endpoints to trusted management addresses or localhost/VPN only, or disabling the MCP integration. Review access logs for unauthenticated requests to /mcp_message and check for unexpected nginx config changes or restarts, which would indicate exploitation.	9.8	36%	PoC	nginxui Nginx UI 2.3.5 and prior (no fix available at publication)	large≈10,000–50,000 exposed Nginx UI instances (order of tens of thousands)	Mar 30, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-33032

Unauthenticated MCP Endpoint Access in Nginx UI Enables Full Nginx Server Takeover

Nginx UI versions 2.3.5 and prior ship a Model Context Protocol (MCP) integration exposed via two HTTP endpoints, /mcp and /mcp_message; while /mcp requires authentication, /mcp_message enforces only IP whitelisting, and the default whitelist is empty, which the middleware treats as allow-all, so the endpoint accepts requests with no authentication (CWE-306, missing authentication for a critical function). An attacker with network reachability to /mcp_message can invoke all MCP tools unauthenticated, including restarting nginx, creating, modifying, or deleting nginx configuration files, and triggering automatic config reloads. This yields complete takeover of the nginx service on the affected host, with critical-severity impact across confidentiality, integrity, and availability (CVSS 3.1: 9.8). All Nginx UI deployments running 2.3.5 or earlier are affected, especially those where the MCP endpoints are reachable from untrusted networks. News reports indicate the flaw is being actively exploited in the wild; it is not yet in CISA KEV, EPSS is high at 36.3% (98th percentile), and no patched release was available at publication.

Do: No fixed release was available at publication — monitor the upstream advisory (GHSA-h6c2-x2m2-mwhf) and the Nginx UI project and upgrade as soon as a patched version ships. Until then, restrict exposure of /mcp_message by setting a non-empty IP whitelist, firewalling the MCP endpoints to trusted management addresses or localhost/VPN only, or disabling the MCP integration. Review access logs for unauthenticated requests to /mcp_message and check for unexpected nginx config changes or restarts, which would indicate exploitation.

9.8

36%

PoC

nginxui Nginx UI 2.3.5 and prior (no fix available at publication)

large≈10,000–50,000 exposed Nginx UI instances (order of tens of thousands)

Mar 30, 2026

Full article411 words · extracted from infosecurity-magazine.com · click to collapse

A critical authentication bypass in nginx-ui, a widely used open-source web interface for managing nginx servers, has been actively exploited in the wild.

The vulnerability, tracked as CVE-2026-33032 with a CVSS score of 9.8, was discovered by Pluto Security and allows any network-adjacent attacker to take full control of an nginx server through a single unauthenticated API request.

VulnCheck has added the flaw to its Known Exploited Vulnerabilities (KEV) list. Recorded Future's Insikt Group independently flagged it in a recent report as one of 31 high-impact vulnerabilities exploited during March 2026, assigning it a risk score of 94 out of 100.

Missing Middleware, Full Access

The root cause comes down to a single missing function call: nginx-ui recently added support for the Model Context Protocol (MCP), which splits communication across two HTTP endpoints.

The /mcp endpoint, used for establishing connections, carries both IP whitelisting and authentication middleware. But /mcp_message, the endpoint that processes every tool invocation including configuration writes and server restarts, shipped without the authentication check.

That omission exposes 12 MCP tools to unauthenticated callers. Seven are destructive, enabling attackers to inject nginx configurations, reload the server and intercept all traffic passing through it. The remaining five provide reconnaissance capabilities such as reading existing configs and mapping backend infrastructure.

Thousands of Instances at Risk

Pluto Security's researchers said they used Shodan to identify over 2,600 publicly reachable nginx-ui instances across cloud providers including Alibaba Cloud, Oracle and Tencent.

Most were running on the default port 9000. The tool's Docker image has been pulled more than 430,000 times, suggesting a much larger population of potentially vulnerable deployments sitting behind firewalls.

The nginx-ui maintainers released a patch in version 2.3.4 just one day after disclosure. The fix amounted to 27 characters of added code, along with a regression test to prevent the same oversight from recurring. Organizations running nginx-ui with MCP enabled should take immediate action:

Update to version 2.3.4 or later
If patching is not possible, disable MCP functionality entirely
Restrict network access to the management interface
Review server logs and configuration directories for unauthorized changes

This is the second MCP vulnerability Pluto Security has disclosed in recent weeks, following MCPwnfluence, an SSRF-to-RCE chain in the Atlassian MCP server.

Both cases expose a recurring weakness: when MCP is connected to existing applications, its endpoints often inherit full capabilities without inheriting any of the security controls.

Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/nginx-ui-mcp-flaw-actively/