Cloud Security

nginx-ui CVE-2026-33032: Two-Request Server Takeover

June 17, 2026 · 6 min read · By CloudAI Security
nginx-ui CVE-2026-33032: Two-Request Server Takeover

CVE-2026-33032 (MCPwn) is a critical authentication bypass in nginx-ui that allows unauthenticated attackers to gain full server control. With CVSS 9.8 severity, the vulnerability affects all versions up to 2.3.3 and is being actively exploited in the wild. Organizations running nginx-ui must immediately patch to version 2.3.4 or disable the vulnerable MCP integration.

What Is CVE-2026-33032?

CVE-2026-33032 (tracked as MCPwn) is a CVSS 9.8 authentication bypass in nginx-ui’s Model Context Protocol integration. The /mcp_message endpoint handles all destructive tool invocations but lacks the AuthRequired() middleware that protects its paired /mcp endpoint. Unauthenticated attackers can invoke 12 MCP tools— including nginx_config_add with auto-reload—to achieve complete nginx takeover in two HTTP requests. Picus Security credits researcher Yotam Perkal with the discovery.

The vulnerability affects all nginx-ui versions up to 2.3.3 with MCP enabled. Patching to version 2.3.4 or later is the only remediation. This is actively exploited in the wild: VulnCheck added CVE-2026-33032 to its Known Exploited Vulnerabilities catalog on April 13, 2026, and Recorded Future’s Insikt Group ranked it among the 31 most-exploited CVEs of March 2026. Vulert’s analysis identifies approximately 2,600 publicly reachable nginx-ui instances globally.

Root Cause: Inconsistent Authentication

The vulnerability stems from a routing configuration error where two endpoints share the same powerful handler but apply different security controls. nginx-ui uses the mcp-go library’s Server-Sent Events transport, which requires two endpoints by design:

  • GET /mcp — opens a persistent event stream, requires IP whitelist and AuthRequired() middleware
  • POST /mcp_message?sessionId=<id> — inbound channel for JSON-RPC tool invocations, requires only IP whitelist

Both routes forward to the same mcp.ServeHTTP() handler, inheriting full administrative power. The /mcp_message endpoint drops the authentication check but retains the tool invocation capabilities. This single missing middleware reference enables unauthenticated access to operations including config writes, nginx reloads, file reads, and service restarts. Intertec Systems’ advisory notes that combining CVE-2026-33032 with CVE-2026-27944 allows credential extraction through the /api/backup endpoint.

Fail-Open IP Whitelisting

With authentication absent, IP whitelisting becomes the only control. The implementation fails open on a default configuration:

if len(settings.AuthSettings.IPWhiteList) == 0 {
    c.Next()  // Empty whitelist → allow everyone
    return
}

Fresh installs, default configurations, and deployments that never touched the IP whitelist setting implicitly permit all network hosts. This transforms a misconfiguration-class flaw into a default-case vulnerability. Every unpatched nginx-ui with MCP enabled is exploitable without any operator action. The fail-open pattern is a classic security anti-pattern—allow by default, block by exception—that amplifies exposure exponentially when the primary control (authentication) is missing.

Attack Chain: Two Requests to Compromise

Exploitation requires no chained gadgets, memory corruption, or sandbox escape. Two HTTP requests complete the attack:

  1. Send GET /mcp to obtain a session ID. The endpoint is authenticated, but the session ID itself is not cryptographically protected.
  2. Send POST /mcp_message?sessionId=<id> with a JSON-RPC payload invoking nginx_config_add or nginx_reload. The endpoint accepts the session ID and executes the privileged action without re-authentication.

A competent adversary can script this in under fifty lines of Python. The attack surface is measurable: Shodan searches for the nginx-ui favicon hash return roughly 2,689 publicly reachable instances hosted across Alibaba Cloud, Oracle Cloud, Tencent Cloud, and DigitalOcean. Major clusters are in China, the United States, Indonesia, Germany, and Hong Kong. Every unpatched instance is a direct gateway to the nginx server and every upstream service it fronts. Vulert reports that attackers are actively scanning for vulnerable instances and automating exploitation.

Impact: Complete Server Takeover

Successful exploitation grants full administrative control over the nginx service. Attackers can:

  • Restart the nginx process at will
  • Modify arbitrary configuration files and trigger automatic reloads
  • Inject malicious access_log directives that capture Authorization headers and other credentials
  • Forge admin JWTs by extracting JwtSecret from hijacked sessions
  • Disable virtual hosts or redirect traffic to attacker-controlled servers
  • Deny service by pushing invalid configurations that crash nginx

nginx-ui typically sits in front of production web applications, APIs, and internal services. Compromising the web server is compromising everything behind it. Traffic interception alone enables credential harvesting, session hijacking, and data exfiltration. The related CVE-2026-27944 exposes /api/backup, which dumps full system backups including credentials, SSL private keys, configuration files, and node secrets. Intertec Systems warns that extracted node secrets establish valid sessions, closing the loop for unrestricted administrative access.

Broader MCP Security Problem

CVE-2026-33032 is not an isolated incident. It exemplifies a systemic security gap in Model Context Protocol integrations. When MCP is added to applications:

  • It inherits full system capabilities by design
  • It may not inherit the application’s security controls by implementation
  • The result is hidden backdoors that bypass authentication

Similar patterns have appeared in other MCP implementations. Atlassian’s MCP flaws (CVE-2026-27825 and CVE-2026-27826) allowed unauthenticated remote code execution within local networks. The emerging pattern: MCP endpoints are powerful, often bypass conventional security layers, and are inconsistently protected. nginx-ui is an 11,000-star GitHub project with 430,000 Docker pulls—production infrastructure that directly faces the internet. The MCP integration was added to enable AI assistant configuration, but the security controls lagged behind the capability addition. This is the AI-adjacent security debt that organizations now inherit in production. The AI security evidence we have covered elsewhere applies equally to MCP integration security.

Detection and Mitigation

Patch immediately: Upgrade to nginx-ui 2.3.4 or later. The fix adds AuthRequired() middleware to /mcp_message and changes IP whitelist behavior to deny-all by default. Organizations running cloud-hosted nginx-ui instances should treat patching as an incident response priority given active exploitation.

Disable MCP if unused: Many deployments may have MCP enabled but never actually use it. Disabling the feature removes the attack surface entirely without requiring an upgrade cycle.

Restrict network access: nginx-ui should not be directly exposed to the internet. Place it behind an authenticated reverse proxy or VPN. Restrict access to management interfaces to internal networks only.

Monitor for exploitation: The attack pattern is distinctive: unexpected /mcp_message POST requests from unauthenticated sources, followed by nginx configuration changes or reloads. SIEM rules should alert on /mcp_message requests from non-whitelisted IP addresses. Log nginx configuration changes and correlate them with management interface access.

Audit for credential exposure: Post-exploitation analysis should check access_log directives for captures of Authorization headers. Rotate any credentials that may have been exposed during the compromise window. Active exploitation patterns suggest attackers move quickly to credential harvesting once initial access is established.

References

Privacy Terms Contact