Critical Nginx-ui MCP Flaw Actively Exploited in the Wild
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33032 | Unauthenticated MCP Endpoint Access in Nginx UI Enables Full Nginx Server Takeover | 9.8 | 35% | PoC |
From the original article
2 min read at infosecurity-magazine.com
A critical authentication bypass in nginx-ui, a widely used open-source web interface for managing nginx servers, has been actively exploited in the wild. The vulnerability, tracked as CVE-2026-33032 with a CVSS score of 9. 8, was discovered by Pluto Security and allows any network-adjacent attacker to take full control of an nginx server through a single unauthenticated API request.
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.