Threat · curated 9 Sep 2026
CVE-2026-33032: Nginx UI Missing MCP Authentication
First reported rapid7.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
CVE-2026-33032 and the underlying MCP design default show that agents' tool layer is an actively exploited attack surface where there is no patch for the protocol-level flaw, forcing defenders to add their own authentication and command validation around every MCP server.
The we45 write-up details a systemic design flaw in the Model Context Protocol's STDIO transport — confirmed by Anthropic as intentional behavior that executes any launch command without validation across every official MCP SDK — which OX Security found exposed across roughly 200,000 instances tied to 150M+ package downloads. It also covers CVE-2026-33032 (CVSS 9.8), a missing-authentication bug in nginx-ui's MCP integration that lets an unauthenticated attacker reach a privileged MCP server; Recorded Future reported in-the-wild exploitation, chained with the CVE-2026-27944 info leak.
Summary
CVE-2026-33032 is a critical (CVSS 9.8) missing-authentication vulnerability in Nginx UI, an open-source web interface for managing Nginx configurations and SSL certificates. The product shipped an MCP (Model Context Protocol) integration so an AI agent could manage Nginx on an administrator's behalf, but one of the two MCP endpoints (/mcp_message) enforced only an IP allow-list that defaulted to 'allow all', letting any unauthenticated attacker invoke every privileged MCP tool.[1][2]
Exploitation results in full attacker control of the managed Nginx service — restarting Nginx, rewriting configuration files, and triggering reloads without credentials. Recorded Future observed in-the-wild exploitation within days of disclosure, and the flaw was chained with the information-leak vulnerability CVE-2026-27944 for more reliable exploitation.[1][2]
No named threat actor is grounded in the evidence; this is an actively exploited vulnerability rather than a coherent attributed campaign. Users are urged to update Nginx UI to the latest version (2.3.6) to resolve version-number discrepancies between the finder's advisory and the CVE record.[1][2]
Attack chain
- Information leak (chained): Attackers exploit CVE-2026-27944, an information-leak vulnerability in Nginx UI, to obtain data that enables reliable access to the MCP server.[1][2]
- Unauthenticated MCP access: Because the /mcp_message endpoint enforces only an IP allow-list that defaults to 'allow all', an unauthenticated remote attacker reaches the MCP server and its privileged tools.[1][2]
- Privileged action / service takeover: The attacker invokes every MCP tool the agent had access to — restarting Nginx, rewriting configuration files, triggering reloads — resulting in full control of the managed Nginx service.[1][2]
Disclosure timeline
| Date | Event |
|---|---|
| Early March 2026 | CVE-2026-33032 reported to the vendor by Pluto Security researcher Yotam Perkal.[2] |
| 2026-03-15 | Vulnerability patched; Pluto Security published a technical blog post with vulnerability details.[2] |
| 2026-03-30 | Security advisory (GHSA-h6c2-x2m2-mwhf) published for Nginx UI.[2] |
| 2026-04-13 | Recorded Future report indicates in-the-wild exploitation of CVE-2026-33032 has begun.[1][2] |
| 2026-04-16 | PurpleOps report associates in-the-wild exploitation with the chained information-leak vulnerability CVE-2026-27944; Rapid7 published its analysis.[1][2] |
How it works
Nginx UI's MCP integration exposed two endpoints. One enforced authentication; its sibling, /mcp_message, enforced only IP allow-listing. In the default configuration the allow-list was empty, and the middleware treated an empty allow-list as 'allow all', so any remote IP could reach MCP functionality without credentials.[1][2]
Because the MCP server can perform privileged operations on managed Nginx web servers, an unauthenticated attacker who reaches /mcp_message can invoke those tools directly, achieving full control of the Nginx service. Exploitation is made more reliable by chaining with CVE-2026-27944, an information-leak vulnerability.[1][2]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Nginx UI | Per the finder's blog, version 2.3.3 and prior; the official CVE record states versions 2.3.5 and below are affected (a discrepancy noted by Rapid7). | Fixed in 2.3.4 per the finder; users are advised to update to the latest version, 2.3.6, to avoid version-number confusion.[2] |
| Nginx UI (CVE-2026-27944, chained info leak) | Information-leak vulnerability exploited alongside CVE-2026-33032. | Patched in version 2.3.3.[2] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2026-33032 | Critical (CVSS 9.8) missing MCP authentication vulnerability in Nginx UI under active exploitation.[1][2] |
| cve | CVE-2026-27944 | Information-leak vulnerability in Nginx UI being exploited in the wild as a chain with CVE-2026-33032.[1][2] |
Key takeaways
- A single missing authentication control on one MCP endpoint gave unauthenticated attackers privileged command execution over managed Nginx infrastructure, demonstrating that the AI agent's tool layer is a distinct trust boundary requiring its own authorization enforcement.[1][2]
- The vulnerability moved from disclosure to in-the-wild exploitation within days and was chained with an information-leak flaw (CVE-2026-27944), underscoring the urgency of patching to Nginx UI 2.3.6 and restricting management-interface exposure.[1][2]
Defensive actions
- Update Nginx UI to the latest version (2.3.6) on an urgent basis.: Remediates CVE-2026-33032 and resolves the version-number discrepancy between the finder's advisory and the CVE record; version 2.3.3 also patches the chained CVE-2026-27944.[2]
- Strictly limit network access to the Nginx UI management interface to only those who require it.: Reduces exposure to this and future vulnerabilities, mitigating the 'allow all' default IP allow-list that exposes MCP functionality to any remote IP.[1][2]
- Authenticate every MCP endpoint consistently rather than assuming siblings inherit a policy.: CVE-2026-33032 existed because one endpoint was authenticated while /mcp_message was not, an inconsistent-authorization failure across routes that should share a policy.[1]