Security Affairspublished Apr 15, 18:17 UTC (Apr 15, 2026)ingested Sep 10, 06:12 UTC@securityaffairs

CVE-2026-33032: severe nginx-ui bug grants unauthenticated server access

criticalVulnerability exploited in the wildimportance 60CVE-2026-33032

Read the original

Tagscve-2026-33032 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-33032	Unauthenticated MCP Endpoint Access in Nginx UI Enables Full Nginx Server Takeover Nginx UI versions 2.3.5 and prior ship a Model Context Protocol (MCP) integration exposed via two HTTP endpoints, /mcp and /mcp_message; while /mcp requires authentication, /mcp_message enforces only IP whitelisting, and the default whitelist is empty, which the middleware treats as allow-all, so the endpoint accepts requests with no authentication (CWE-306, missing authentication for a critical function). An attacker with network reachability to /mcp_message can invoke all MCP tools unauthenticated, including restarting nginx, creating, modifying, or deleting nginx configuration files, and triggering automatic config reloads. This yields complete takeover of the nginx service on the affected host, with critical-severity impact across confidentiality, integrity, and availability (CVSS 3.1: 9.8). All Nginx UI deployments running 2.3.5 or earlier are affected, especially those where the MCP endpoints are reachable from untrusted networks. News reports indicate the flaw is being actively exploited in the wild; it is not yet in CISA KEV, EPSS is high at 36.3% (98th percentile), and no patched release was available at publication. Do: No fixed release was available at publication — monitor the upstream advisory (GHSA-h6c2-x2m2-mwhf) and the Nginx UI project and upgrade as soon as a patched version ships. Until then, restrict exposure of /mcp_message by setting a non-empty IP whitelist, firewalling the MCP endpoints to trusted management addresses or localhost/VPN only, or disabling the MCP integration. Review access logs for unauthenticated requests to /mcp_message and check for unexpected nginx config changes or restarts, which would indicate exploitation.	9.8	36%	PoC	nginxui Nginx UI 2.3.5 and prior (no fix available at publication)	large≈10,000–50,000 exposed Nginx UI instances (order of tens of thousands)	Mar 30, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-33032

Unauthenticated MCP Endpoint Access in Nginx UI Enables Full Nginx Server Takeover

Nginx UI versions 2.3.5 and prior ship a Model Context Protocol (MCP) integration exposed via two HTTP endpoints, /mcp and /mcp_message; while /mcp requires authentication, /mcp_message enforces only IP whitelisting, and the default whitelist is empty, which the middleware treats as allow-all, so the endpoint accepts requests with no authentication (CWE-306, missing authentication for a critical function). An attacker with network reachability to /mcp_message can invoke all MCP tools unauthenticated, including restarting nginx, creating, modifying, or deleting nginx configuration files, and triggering automatic config reloads. This yields complete takeover of the nginx service on the affected host, with critical-severity impact across confidentiality, integrity, and availability (CVSS 3.1: 9.8). All Nginx UI deployments running 2.3.5 or earlier are affected, especially those where the MCP endpoints are reachable from untrusted networks. News reports indicate the flaw is being actively exploited in the wild; it is not yet in CISA KEV, EPSS is high at 36.3% (98th percentile), and no patched release was available at publication.

Do: No fixed release was available at publication — monitor the upstream advisory (GHSA-h6c2-x2m2-mwhf) and the Nginx UI project and upgrade as soon as a patched version ships. Until then, restrict exposure of /mcp_message by setting a non-empty IP whitelist, firewalling the MCP endpoints to trusted management addresses or localhost/VPN only, or disabling the MCP integration. Review access logs for unauthenticated requests to /mcp_message and check for unexpected nginx config changes or restarts, which would indicate exploitation.

9.8

36%

PoC

nginxui Nginx UI 2.3.5 and prior (no fix available at publication)

large≈10,000–50,000 exposed Nginx UI instances (order of tens of thousands)

Mar 30, 2026

Full article377 words · extracted from securityaffairs.com · click to collapse

An actively exploited critical nginx-ui flaw (CVE-2026-33032) lets attackers bypass authentication and take full control of Nginx servers.

A critical vulnerability in nginx-ui, tracked as CVE-2026-33032 (CVSS score of 9.8), is being actively exploited, allowing attackers to bypass authentication and fully take over Nginx servers. The issue stems from improper protection of the /mcp_message endpoint, which relies only on IP whitelisting. Since the default whitelist allows all, attackers can access the service without authentication and gain control.

“The nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting – and the default IP whitelist is empty, which the middleware treats as “allow all”.” reads the advisory. “This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads – achieving complete nginx service takeover.”

Yotam Perkal of Pluto Security discovered the nginx-ui flaw. The researcher pointed out that it can be exploited in seconds using just two HTTP requests.

“The attack flow: step 1 authenticates to get a session, step 2 uses that session to invoke destructive tools with zero authentication.” wrote Perkal. “An attacker on the same network as the nginx-ui instance needs just two requests:

POST /mcp_message?sessionId=xxx – Invoke any tool. No node_secret. No JWT. No cookies. Nothing.
GET /mcp?node_secret=xxx – Establish an SSE session, get a sessionId”

A single unauthenticated request can let attackers fully compromise nginx-ui. They can intercept all traffic by redirecting it through malicious servers, capture admin credentials via manipulated logs, and gain persistent access by stealing tokens and secrets. Attackers can also map the entire infrastructure by reading configs and even shut down services by pushing invalid configurations.

The flaw was fixed in nginx-ui version 2.3.4 by adding a missing authentication check to the /mcp_message endpoint, just one line of code. The update also introduced a regression test to ensure both endpoints require authentication, which would have prevented the issue. Notably, some version trackers are incorrect: v2.3.3 is the last vulnerable release, while v2.3.4 includes the fix.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, nginx)

Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/190841/hacking/cve-2026-33032-severe-nginx-ui-bug-grants-unauthenticated-server-access.html