# CVE-2026-33032 (MCPwn): nginx-ui Middleware Bypass Enabling Unauthenticated Configuration Write and Full Web Server Takeover

> A critical authentication middleware bypass in nginx-ui (a widely deployed open-source web management UI for nginx) allows unauthenticated remote attackers to invoke privileged Management Control Plane (MCP) configuration endpoints. The flaw, dubbed 'MCPwn', enables arbitrary writes to nginx configuration files on disk and the loading of attacker-controlled Lua modules, leading to reliable remote code execution as the nginx worker user. CISA added CVE-2026-33032 to the KEV catalog on 2026-04-15 after Unit 42 confirmed mass exploitation by multiple threat clusters, including opportunistic cryptojacking botnets and at least one financially motivated intrusion set deploying webshells for hands-on-keyboard access.

- **Published:** 2026-04-16T12:00:00Z
- **Last reviewed:** 2026-04-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0381
- **ID:** TL-2026-0381
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33032

## Description

CVE-2026-33032 (CVSS 9.8) is an authentication middleware bypass in nginx-ui versions 2.0.0 through 2.0.5, the web-based administrative interface bundled with thousands of cPanel-style hosting stacks, small-business reverse proxies, and homelab appliances. The vulnerability resides in the Gin-based HTTP router middleware chain located at internal/router/router.go. The routing logic uses an unanchored regular expression (`^/api/auth`) to whitelist public authentication endpoints from the JWT verification middleware. Because the expression is not anchored at end-of-path and is evaluated against the full URI path including an attacker-controllable trailing segment, any request whose path begins with the literal prefix `/api/auth` — including `/api/auth/../system/config` and `/api/auth%2F..%2Fsystem%2Fconfig` — bypasses the session/JWT check entirely and reaches the privileged handler behind the middleware.

The privileged handlers exposed behind the bypass include /api/system/config (write arbitrary nginx configuration fragments to /etc/nginx/conf.d/), /api/system/reload (trigger nginx reload to pick up writes), /api/system/backup (read arbitrary files via a path traversal in the archive name parameter), and /api/mcp/plugin/install (upload and register Lua modules to be loaded by the `lua_package_path` and `content_by_lua_block` directives). By chaining a configuration write that injects a `load_module` or a Lua `content_by_lua_block` into a virtual host served by the same nginx instance, an unauthenticated attacker gains reliable code execution as the nginx worker user (typically `www-data`, `nginx`, or root on appliance images). Where nginx-ui is run as root (the default in the official Docker image and in several vendor appliances), the bypass yields immediate root RCE on the host.

The public proof-of-concept published by security researcher @kevintyj on 2026-04-13 is a ~80-line Python script that sends a single multipart POST to `/api/auth/%2e%2e/system/config` containing an `nginx.conf` fragment with a reverse-shell Lua block, then POSTs to `/api/auth/%2e%2e/system/reload` to activate the configuration. Exploitation leaves highly recognisable telemetry: 200-OK responses on POST /api/auth/%2f..%2fsystem/* and /api/auth/..%2fsystem/* requests, followed by writes to /etc/nginx/conf.d/*.conf and spawning of /bin/sh or /bin/bash from the nginx master or worker process.

Unit 42 telemetry shows initial scan-and-exploit waves beginning at 2026-04-11 03:00 UTC from a cluster of VPS-hosted IPs previously associated with the 8220 Gang cryptojacking operation, followed within 36 hours by exploitation from a more targeted cluster dropping a custom Go-based webshell (SHA-256 a3f6...d921) and pivoting into internal networks via nginx-ui's privileged network position. BleepingComputer reporting corroborates at least 12,000 internet-exposed nginx-ui instances before the patch, of which an estimated 40% remained unpatched at the time of the CISA KEV addition. CISA Binding Operational Directive 22-01 mandates federal civilian agency remediation by 2026-05-06.

Affected deployments include standalone nginx-ui installs from upstream (0x2E/nginx-ui GitHub releases <= 2.0.5), several Synology/QNAP NAS community packages, CyberPanel <= 2.4.1 which bundles nginx-ui for reverse-proxy management, and the Hestia Control Panel nginx-proxy module. Fixed in nginx-ui 2.0.6 (released 2026-04-12), which anchors the auth-whitelist regex to `^/api/auth/(login|logout|refresh|csrf)$` and adds explicit URI-path normalisation before middleware evaluation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1489 Service Stop

## Sources

- [CISA Advisory AA26-106A: nginx-ui Middleware Bypass Exploited in the Wild](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-106a)
- [CISA KEV Catalog: CVE-2026-33032](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD — CVE-2026-33032](https://nvd.nist.gov/vuln/detail/CVE-2026-33032)
- [GitHub Security Advisory GHSA-mcpw-nginx-ui-33032](https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mcpw-nginx-ui-33032)
- [Unit 42 — MCPwn nginx-ui Exploitation Telemetry and IOCs](https://unit42.paloaltonetworks.com/mcpwn-nginx-ui-exploitation/)
- [BleepingComputer — MCPwn attackers using nginx-ui as initial access](https://www.bleepingcomputer.com/news/security/mcpwn-nginx-ui-middleware-bypass-exploited-in-the-wild/)
- [nginx-ui 2.0.6 Release Notes & Fix Commit 6b3f1a2](https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.6)
- [Public PoC — kevintyj/CVE-2026-33032-mcpwn](https://github.com/kevintyj/CVE-2026-33032-mcpwn)
- [Shadowserver Foundation — Exposed nginx-ui Instance Scan Report](https://www.shadowserver.org/news/scanning-exposed-nginx-ui-cve-2026-33032/)
- [GreyNoise — CVE-2026-33032 Tag and Exploitation Traffic](https://www.greynoise.io/tags/cve-2026-33032-nginx-ui-middleware-bypass)
- [SANS ISC Diary — MCPwn Exploitation Observations](https://isc.sans.edu/diary/MCPwn+Exploitation+Observations/31104)
- [Censys — Internet-Exposed nginx-ui Census](https://censys.com/blog/nginx-ui-internet-exposure-cve-2026-33032/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0381