Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachment` MCP tool accepts a `download_path` parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the server process has write access to. Because the attacker controls both the write destination and the written content (via an uploaded Confluence attachment), this constitutes for arbitrary code execution (for example, writing a valid cron entry to `/etc/cron.d/` achieves code execution within one scheduler cycle with no server restart required). Version 0.17.0 fixes the issue.

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an `Authorization` header. No authentication is required. The vulnerability exists in the HTTP middleware and dependency injection layer — not in any MCP tool handler - making it invisible to tool-level code analysis. In cloud deployments, this could enable theft of IAM role credentials via the instance metadata endpoint (`169[.]254[.]169[.]254`). In any HTTP deployment it enables internal network reconnaissance and injection of attacker-controlled content into LLM tool results. Version 0.17.0 fixes the issue.

Nginx UI (a third-party web administration interface for the Nginx web server) prior to version 2.3.3 exposes its /api/backup endpoint without any authentication (CWE-306) and returns the backup encryption keys in the X-Backup-Security response header (CWE-311). Any unauthenticated attacker who can reach the endpoint over the network can send a single request and receive a full system backup containing user credentials, session tokens, SSL/TLS private keys, and Nginx configurations, then decrypt it immediately using the key leaked in the same response. This effectively hands the attacker the secrets needed to impersonate administrators, decrypt protected data, and potentially take over the underlying Nginx server. All deployments running Nginx UI before 2.3.3 are affected, with the greatest risk on instances where the API is reachable from the internet or from untrusted networks. A public security advisory has been published; the flaw is not yet in CISA KEV, but EPSS assigns a 22.2% probability of exploitation within 30 days (98th percentile), and a separate Nginx UI flaw (CVE-2026-33032) is reported as actively exploited, indicating attackers are targeting this product.

Do: Upgrade Nginx UI to version 2.3.3 or later immediately. If upgrading is not possible, restrict network access to the /api/backup endpoint (firewall rules, allowlists, or placing the interface behind authentication or on localhost only), and check access logs for unauthenticated requests to /api/backup or downloads using the X-Backup-Security header. If exposure is suspected, rotate all secrets contained in backups, including admin passwords, SSL/TLS private keys, and active session tokens.

Nginx UI versions 2.3.5 and prior ship a Model Context Protocol (MCP) integration exposed via two HTTP endpoints, /mcp and /mcp_message; while /mcp requires authentication, /mcp_message enforces only IP whitelisting, and the default whitelist is empty, which the middleware treats as allow-all, so the endpoint accepts requests with no authentication (CWE-306, missing authentication for a critical function). An attacker with network reachability to /mcp_message can invoke all MCP tools unauthenticated, including restarting nginx, creating, modifying, or deleting nginx configuration files, and triggering automatic config reloads. This yields complete takeover of the nginx service on the affected host, with critical-severity impact across confidentiality, integrity, and availability (CVSS 3.1: 9.8). All Nginx UI deployments running 2.3.5 or earlier are affected, especially those where the MCP endpoints are reachable from untrusted networks. News reports indicate the flaw is being actively exploited in the wild; it is not yet in CISA KEV, EPSS is high at 36.3% (98th percentile), and no patched release was available at publication.

Do: No fixed release was available at publication — monitor the upstream advisory (GHSA-h6c2-x2m2-mwhf) and the Nginx UI project and upgrade as soon as a patched version ships. Until then, restrict exposure of /mcp_message by setting a non-empty IP whitelist, firewalling the MCP endpoints to trusted management addresses or localhost/VPN only, or disabling the MCP integration. Review access logs for unauthenticated requests to /mcp_message and check for unexpected nginx config changes or restarts, which would indicate exploitation.