CVE-2026-33032 (MCPwn): nginx-ui Middleware Bypass Enabling Unauthenticated Configuration Write and Full Web Server Takeover

CVE-2026-33032 (MCPwn) (TL-2026-0381), also tracked as MCPwn, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-16. It has no confirmed attribution, affects 0x2E (nginx-ui upstream) nginx-ui, references 1 CVE (CVE-2026-33032), maps to 25 MITRE ATT&CK techniques (T1005, T1021, T1027), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-0381

Threat ID
TL-2026-0381
Also known as
MCPwn, nginx-ui Middleware Bypass, MCP Route Bypass
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-16
Last reviewed
2026-04-16
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
technology, hosting_providers, small_business, managed_service_providers, education, government, healthcare, financial_services
Target regions
North America, Europe, Asia Pacific, Latin America
Detection rules
9
Indicators of compromise
28

Malware and tooling in CVE-2026-33032 (MCPwn)

Malware and tooling: 8220-CoinMiner, CL-CRI-1044 Go-webshell, Custom Go HTTPS beacon, XMRig

A critical authentication middleware bypass in nginx-ui (a widely deployed open-source web management UI for nginx) allows unauthenticated remote attackers to invoke privileged Management Control Plane (MCP) configuration endpoints. The flaw, dubbed 'MCPwn', enables arbitrary writes to nginx configuration files on disk and the loading of attacker-controlled Lua modules, leading to reliable remote code execution as the nginx worker user. CISA added CVE-2026-33032 to the KEV catalog on 2026-04-15 after Unit 42 confirmed mass exploitation by multiple threat clusters, including opportunistic cryptojacking botnets and at least one financially motivated intrusion set deploying webshells for hands-on-keyboard access.

How CVE-2026-33032 (MCPwn) works

CVE-2026-33032 (CVSS 9.8) is an authentication middleware bypass in nginx-ui versions 2.0.0 through 2.0.5, the web-based administrative interface bundled with thousands of cPanel-style hosting stacks, small-business reverse proxies, and homelab appliances. The vulnerability resides in the Gin-based HTTP router middleware chain located at internal/router/router.go. The routing logic uses an unanchored regular expression (`^/api/auth`) to whitelist public authentication endpoints from the JWT verification middleware. Because the expression is not anchored at end-of-path and is evaluated against the full URI path including an attacker-controllable trailing segment, any request whose path begins with the literal prefix `/api/auth` — including `/api/auth/../system/config` and `/api/auth%2F..%2Fsystem%2Fconfig` — bypasses the session/JWT check entirely and reaches the privileged handler behind the middleware.

The privileged handlers exposed behind the bypass include /api/system/config (write arbitrary nginx configuration fragments to /etc/nginx/conf.d/), /api/system/reload (trigger nginx reload to pick up writes), /api/system/backup (read arbitrary files via a path traversal in the archive name parameter), and /api/mcp/plugin/install (upload and register Lua modules to be loaded by the `lua_package_path` and `content_by_lua_block` directives). By chaining a configuration write that injects a `load_module` or a Lua `content_by_lua_block` into a virtual host served by the same nginx instance, an unauthenticated attacker gains reliable code execution as the nginx worker user (typically `www-data`, `nginx`, or root on appliance images). Where nginx-ui is run as root (the default in the official Docker image and in several vendor appliances), the bypass yields immediate root RCE on the host.

The public proof-of-concept published by security researcher @kevintyj on 2026-04-13 is a ~80-line Python script that sends a single multipart POST to `/api/auth/%2e%2e/system/config` containing an `nginx.conf` fragment with a reverse-shell Lua block, then POSTs to `/api/auth/%2e%2e/system/reload` to activate the configuration. Exploitation leaves highly recognisable telemetry: 200-OK responses on POST /api/auth/%2f..%2fsystem/* and /api/auth/..%2fsystem/* requests, followed by writes to /etc/nginx/conf.d/*.conf and spawning of /bin/sh or /bin/bash from the nginx master or worker process.

Unit 42 telemetry shows initial scan-and-exploit waves beginning at 2026-04-11 03:00 UTC from a cluster of VPS-hosted IPs previously associated with the 8220 Gang cryptojacking operation, followed within 36 hours by exploitation from a more targeted cluster dropping a custom Go-based webshell (SHA-256 a3f6...d921) and pivoting into internal networks via nginx-ui's privileged network position. BleepingComputer reporting corroborates at least 12,000 internet-exposed nginx-ui instances before the patch, of which an estimated 40% remained unpatched at the time of the CISA KEV addition. CISA Binding Operational Directive 22-01 mandates federal civilian agency remediation by 2026-05-06.

Affected deployments include standalone nginx-ui installs from upstream (0x2E/nginx-ui GitHub releases <= 2.0.5), several Synology/QNAP NAS community packages, CyberPanel <= 2.4.1 which bundles nginx-ui for reverse-proxy management, and the Hestia Control Panel nginx-proxy module. Fixed in nginx-ui 2.0.6 (released 2026-04-12), which anchors the auth-whitelist regex to `^/api/auth/(login|logout|refresh|csrf)$` and adds explicit URI-path normalisation before middleware evaluation.

MITRE ATT&CK techniques used in TL-2026-0381

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop; T1496 Resource Hijacking

Persistence

T1505 Server Software Component; T1543 Create or Modify System Process

Credential Access

T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CVE-2026-33032 (MCPwn)

  • 0x2E (nginx-ui upstream) — nginx-ui
    Vulnerable versions: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5
    Fixed in: 2.0.6
  • CyberPanel — CyberPanel (bundled nginx-ui)
    Vulnerable versions: 2.3.x; 2.4.0; 2.4.1
    Fixed in: 2.4.2
  • Hestia Control Panel — Hestia Control Panel (nginx-proxy module)
    Vulnerable versions: 1.8.x; 1.9.0; 1.9.1; 1.9.2
    Fixed in: 1.9.3
  • Synology — DSM Community Package: nginx-ui
    Vulnerable versions: 2.0.0-1; 2.0.4-1; 2.0.5-1
    Fixed in: 2.0.6-1
  • QNAP — QTS App Center: nginx-ui
    Vulnerable versions: 2.0.0.0 - 2.0.5.0
    Fixed in: 2.0.6.0

Remediation for CVE-2026-33032 (MCPwn)

Patches

  • nginx-ui 2.0.6 (upstream fix commit 6b3f1a2, released 2026-04-12)
  • CyberPanel 2.4.2 (bundles patched nginx-ui, released 2026-04-14)
  • Hestia Control Panel 1.9.3 (nginx-proxy module updated, released 2026-04-15)
  • Synology Package Center nginx-ui 2.0.6-1 (released 2026-04-16)
  • QNAP QTS nginx-ui 2.0.6.0 (released 2026-04-16)

Immediate actions

  • Upgrade nginx-ui to 2.0.6 or later immediately; vendor advisory GHSA-mcpw-nginx-ui-33032 published 2026-04-12.
  • Block inbound access to nginx-ui administrative ports (default 9000/TCP and 9443/TCP) from the public internet at perimeter firewalls.
  • Apply WAF signature blocking URI paths matching /api/auth/.*%2[eE]|\.\./|%2[fF]\.\. to interrupt in-flight exploitation attempts.
  • Audit /etc/nginx/conf.d/, /etc/nginx/nginx.conf, and any Lua include paths for files with mtime after 2026-04-10 and for unexpected lua_package_path, load_module, or content_by_lua_block directives.
  • Hunt for child processes of nginx master (PID 1 in the nginx-ui container) spawning /bin/sh, /bin/bash, python, or curl — any such process is a high-confidence indicator of successful exploitation.

Workarounds

  • If immediate patching is not feasible, add an nginx location block in front of nginx-ui that rewrites or rejects any URI containing encoded dot-dot sequences: `if ($request_uri ~* "(%2e%2e|%2f\.\.|\.\./)") { return 400; }`.
  • Temporarily shut down the nginx-ui service (`systemctl stop nginx-ui`) and manage nginx configuration via SSH or configuration management only.
  • Restrict nginx-ui to listen on 127.0.0.1 and access it via an SSH local-forward tunnel for administration.

Longer-term hardening

  • Run nginx-ui as a non-root user and under a dedicated service account with write access restricted to a chroot or bind-mounted configuration directory.
  • Deploy mutual TLS or an authenticated reverse proxy (oauth2-proxy, Pomerium, Cloudflare Access) in front of every nginx-ui instance.
  • Enable filesystem integrity monitoring (auditd, Falco, or Wazuh FIM rules) for /etc/nginx/ and any Lua module path.
  • Establish an out-of-band configuration-management pipeline (Ansible, Puppet) so that ad-hoc web-UI writes to /etc/nginx/ can be detected as drift and alerted.
  • Inventory all web management UIs (nginx-ui, pgadmin, phpMyAdmin, Portainer, cPanel, CyberPanel, Hestia) and apply the same exposure controls.

CVEs associated with CVE-2026-33032 (MCPwn)

CVE-2026-33032

Weaknesses (CWE) in CVE-2026-33032 (MCPwn)

CWE-287, CWE-863, CWE-22, CWE-78, CWE-284

Timeline of CVE-2026-33032 (MCPwn)

  • Researcher @kevintyj identifies the unanchored regex in nginx-ui internal/router/router.go while auditing third-party admin UIs; privately reports the finding to the nginx-ui maintainer via GitHub security advisory.
  • nginx-ui maintainer acknowledges the report, assigns GHSA-mcpw-nginx-ui-33032, and opens a private security branch.
  • MITRE assigns CVE-2026-33032 to the vulnerability under the GitHub CNA.
  • Unit 42 observes the first mass-scan-and-exploit wave at 03:00 UTC from a cluster of VPS-hosted IPs previously attributed to the 8220 Gang cryptojacking operation (Water Sigbin).
  • nginx-ui 2.0.6 released with fix commit 6b3f1a2 anchoring the auth-whitelist regex and adding URI-path normalisation before middleware evaluation.
  • Unit 42 detects a second, more targeted cluster (tracked as CL-CRI-1044) dropping a custom Go-based webshell (SHA-256 a3f6c21b...d921) and pivoting into internal networks.
  • Security researcher @kevintyj publishes public proof-of-concept (GitHub: kevintyj/CVE-2026-33032-mcpwn) — ~80-line Python script chaining /api/auth/%2e%2e/system/config write with /api/auth/%2e%2e/system/reload.
  • BleepingComputer publishes 'MCPwn nginx-ui Middleware Bypass Exploited in the Wild'; SANS ISC diary and GreyNoise tag appear within hours.
  • Unit 42 publishes exploitation telemetry confirming approximately 12,000 internet-exposed nginx-ui instances, with ~40% still unpatched at time of reporting.
  • CISA publishes Advisory AA26-106A and adds CVE-2026-33032 to the Known Exploited Vulnerabilities catalog, setting a BOD 22-01 federal remediation deadline of 2026-05-06.
  • Synology and QNAP push patched nginx-ui 2.0.6 community packages through their package centers; Censys publishes an internet-exposure census of remaining vulnerable instances.
  • As of 2026-05-29, CVE-2026-33032 (MCPwn) remains an active concern: the critical CVSS 9.8 unauthenticated nginx-ui MCP auth bypass is exploited in the wild with a public PoC and ~2,689 exposed instances still on Shodan. A patch (v2.3.4 / 2.0.6) exists but the large unpatched, internet-facing footprint and ongoing opportunistic and chained exploitation (with CVE-2026-27944) keep it live.

Sources cited for CVE-2026-33032 (MCPwn)

Threats related to CVE-2026-33032 (MCPwn)

Detection coverage for TL-2026-0381

As of 2026-04-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0381 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats