cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Actively Exploited nginx-ui Flaw Enables Unauthenticated Server Takeover

· Original article ↗

Summary

CVE-2026-33032 lets unauthenticated attackers invoke nginx-ui MCP tools through /mcp_message to alter and reload Nginx configuration. Active exploitation and public PoCs are reported; users should upgrade to 2.3.6 or apply the fix.

Key points

  • The article reports active exploitation of CVE-2026-33032, an unauthenticated flaw in nginx-ui’s /mcp_message endpoint.
  • An attacker with network access can establish an SSE connection, open an MCP session, and use its sessionID to send requests.
  • The exposed MCP tools can read or modify Nginx configuration and trigger reloads, potentially enabling server takeover.
  • Public proof-of-concept exploits are available, according to the article.
  • Pluto Security estimated that about 2,600 internet-exposed instances may be vulnerable based on scans using Shodan.
  • The fix was released in nginx-ui 2.3.4; the article identifies 2.3.6 as the latest secure version and urges administrators to update.

Article Details

Vulnerability Types
  • Authentication bypass
Severity
Critical
Exploitation Status
active
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1005 · Data from Local SystemThe article says attackers can read and exfiltrate nginx configuration files through the exposed MCP tools.T1190 · Exploit Public-Facing ApplicationAttackers exploit the unauthenticated /mcp_message endpoint in nginx-ui to invoke privileged MCP actions.T1565.001 · Stored Data ManipulationAttackers can write or modify nginx configuration files, including injecting a malicious server block.

CVE

CVE-2026-330320xJacky · nginx-uiThe flaw (CVE-2026-33032) is being actively exploited in the wild with public PoCs available, and administrators are urged to upgrade to nginx-ui 2.3.6 or apply the released fix immediately.

People

Yotam PerkalPluto Security's report, as described in the article, explains the network-access steps used to exploit the vulnerability.

Products

NGINXA critical unauthenticated vulnerability in nginx-ui’s Model Context Protocol (MCP) allows attackers to invoke privileged actions via the /mcp_message endpoint to modify and reload Nginx configuration, enabling fullNginx UIA critical unauthenticated vulnerability in nginx-ui’s Model Context Protocol (MCP) allows attackers to invoke privileged actions via the /mcp_message endpoint to modify and reload Nginx configuration, enabling full

Tools

ShodanBased on Pluto Security’s internet scans using the Shodan engine, there are currently 2,600 publicly exposed instances potentially vulnerable to attacks.

Countries

ChinaMost are in China, the United States, Indonesia, Germany, and Hong Kong.GermanyMost are in China, the United States, Indonesia, Germany, and Hong Kong.Hong KongMost are in China, the United States, Indonesia, Germany, and Hong Kong.IndonesiaMost are in China, the United States, Indonesia, Germany, and Hong Kong.United StatesMost are in China, the United States, Indonesia, Germany, and Hong Kong.

Related Articles