Nginx UI Authentication Bypass via Unauthenticated MCP Endpoint (CVE-2026-33032)

Nginx UI Authentication Bypass via Unauthenticated MCP (TL-2026-0388), also tracked as Nginx UI MCP Auth Bypass, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-17. It has no confirmed attribution, affects 0xJacky nginx-ui, references 1 CVE (CVE-2026-33032), maps to 24 MITRE ATT&CK techniques (T1005, T1041, T1046), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-0388

Threat ID
TL-2026-0388
Also known as
Nginx UI MCP Auth Bypass, GHSA-h6c2-x2m2-mwhf
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-17
Last reviewed
2026-04-17
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, cloud-hosting, e-commerce, media, small-business, education, financial, government
Target regions
Asia, North America, Europe, Global
Detection rules
9
Indicators of compromise
21

Malware and tooling in Nginx UI Authentication Bypass via Unauthenticated MCP

Malware and tooling: Model Context Protocol (MCP)

Nginx UI (0xJacky/nginx-ui) ships an unauthenticated Model Context Protocol (MCP) Server-Sent Events endpoint at /mcp_message that lets any network-reachable attacker invoke 12 MCP tools — including nginx_config_add, nginx_config_modify, and reload_nginx — to rewrite web server configurations and hijack proxied traffic. Approximately 2,600 publicly exposed instances (default TCP/9000) are reachable on the internet, with active in-the-wild exploitation confirmed by Recorded Future and VulnCheck. Patched in v2.3.4 (with further hardening in v2.3.6); CVSS 9.8 critical.

How Nginx UI Authentication Bypass via Unauthenticated MCP works

CVE-2026-33032 is a critical authentication bypass (CWE-306: Missing Authentication for Critical Function) in nginx-ui, a popular web-based Nginx management tool with 11,000+ GitHub stars and 430,000+ Docker pulls. The vulnerability stems from asymmetric authentication in mcp/router.go: the GET /mcp endpoint (which opens the MCP Server-Sent Events stream) is protected by both IPWhiteList() and AuthRequired() middleware, while the POST /mcp_message endpoint (which actually dispatches MCP tool invocations) is protected only by IPWhiteList(). Both endpoints route to the same gin.Context handler mcp.ServeHTTP(c), meaning any tool exposed on /mcp is equally reachable on /mcp_message without credentials.

The IPWhiteList middleware fails open: when settings.AuthSettings.IPWhiteList is empty (the default), the check evaluates len(list) == 0 and calls c.Next() — granting access to any source address. The node_secret query parameter that gates /mcp SSE connections is also not validated on /mcp_message. A remote unauthenticated attacker therefore only needs: (1) one connection to GET /mcp?node_secret=anything to obtain a sessionId, then (2) POST /mcp_message?sessionId=<id> with any valid JSON-RPC MCP tool call. On many deployments step 1 can also be executed without the node_secret thanks to the same empty-whitelist default.

The MCP interface exposes 12 tools, with seven offering direct destructive capability: nginx_config_add (creates a config file and auto-reloads nginx), nginx_config_modify, nginx_config_enable, nginx_config_disable, nginx_config_rename, nginx_config_mkdir, reload_nginx, and restart_nginx. Five reconnaissance tools — nginx_config_get, nginx_config_list, nginx_config_base_path, nginx_config_history, and nginx_status — allow full topology disclosure. Because nginx-ui runs as the privileged process managing the nginx binary, successful exploitation yields complete takeover of the proxy tier: attackers can inject a rogue server block to hijack TLS-terminated traffic, add a log_format directive that captures Authorization headers, extract JwtSecret to forge admin tokens, chain to backend services through the compromised reverse proxy, or corrupt the configuration to cause service-wide DoS.

The vulnerability was discovered by Yotam Perkal (yotampe-pluto) of Pluto Security on 2026-03-04 and reported through GitHub Private Vulnerability Reporting the same day. Maintainer 0xJacky shipped the single-line fix (adding middleware.AuthRequired() to the /mcp_message route) on 2026-03-14 and released nginx-ui v2.3.4 on 2026-03-15. GitHub Security Advisory GHSA-h6c2-x2m2-mwhf was published 2026-03-28 and CVE-2026-33032 landed in NVD on 2026-03-30. Recorded Future confirmed opportunistic exploitation in March 2026; VulnCheck added the CVE to its KEV list on 2026-04-13. As of 2026-04-17 Shodan still indexes ~2,600 unpatched instances, concentrated on cloud hosts at Alibaba Cloud, Oracle Cloud, Tencent Cloud, and DigitalOcean — with the majority listening on default TCP/9000. Administrators should upgrade immediately to v2.3.6 (which also hardens WebSocket origin validation), disable MCP entirely if unused (config key MCP.Enabled=false), or — as a stopgap — populate IPWhiteList with trusted source addresses and block TCP/9000 at the perimeter.

MITRE ATT&CK techniques used in TL-2026-0388

Collection

T1005 Data from Local System; T1602 Data from Configuration Repository

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070 Indicator Removal; T1078 Valid Accounts

Command and Control

T1071 Application Layer Protocol; T1090 Proxy

Persistence

T1098 Account Manipulation; T1505 Server Software Component

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Impact

T1489 Service Stop; T1498 Network Denial of Service

Credential Access

T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle; T1606 Forge Web Credentials

defense-impairment

T1556 Modify Authentication Process

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in Nginx UI Authentication Bypass via Unauthenticated MCP

  • 0xJacky — nginx-ui
    Vulnerable versions: <=2.3.3; 2.3.4-early; <=2.3.5
    Fixed in: 2.3.4; 2.3.6 (recommended)
  • nginxui — nginx_ui (Docker image uozi/nginx-ui)
    Vulnerable versions: <=2.3.5; latest tag pulled before 2026-03-15
    Fixed in: v2.3.6; v2.3.4

Remediation for Nginx UI Authentication Bypass via Unauthenticated MCP

Patches

  • nginx-ui v2.3.4 — initial fix (commit adds middleware.AuthRequired() to /mcp_message route in mcp/router.go)
  • nginx-ui v2.3.6 — recommended secure release (additionally hardens WebSocket origin validation via WebSocketTrustedOrigins)

Immediate actions

  • Upgrade nginx-ui to v2.3.6 or later immediately
  • If upgrade is not possible, set MCP.Enabled=false in app.ini and restart nginx-ui
  • Populate AuthSettings.IPWhiteList with explicit trusted management-plane source addresses so the fail-open default no longer applies
  • Block inbound TCP/9000 (and any custom nginx-ui listen port) at the perimeter and restrict to a management VLAN or VPN
  • Audit nginx configuration directories (conf.d/, sites-enabled/, servers/) for unexpected server{} blocks, proxy_pass targets, or log_format directives capturing Authorization headers
  • Rotate JwtSecret in nginx-ui settings and invalidate all existing admin sessions
  • Search access logs for POST /mcp_message and GET /mcp requests from unexpected source IPs over the last 45 days

Workarounds

  • Disable the MCP integration by setting MCP.Enabled=false in app.ini
  • Restrict access with a strict non-empty AuthSettings.IPWhiteList entry (e.g., 127.0.0.1/32, management-VLAN CIDR only)
  • Front nginx-ui with an authenticating reverse proxy (Cloudflare Access, oauth2-proxy, Pomerium) and block direct port 9000 access
  • Add a host firewall rule (iptables/ufw) dropping inbound traffic to TCP/9000 except from trusted sources

Longer-term hardening

  • Treat MCP endpoints on all tooling as authenticated attack surface — require mTLS or per-request JWT even on internal networks
  • Deploy EDR and file-integrity monitoring on nginx-ui hosts to catch unexpected config file creations and nginx -s reload events
  • Isolate web-management UIs on a dedicated admin network; never expose port 9000 to the public internet
  • Standardize on deny-by-default IP allowlists rather than empty-list fail-open patterns across all Go/Gin middleware
  • Subscribe to 0xJacky/nginx-ui GitHub Security Advisories and add VulnCheck KEV feed to vulnerability management pipeline

CVEs associated with Nginx UI Authentication Bypass via Unauthenticated MCP

CVE-2026-33032

Weaknesses (CWE) in Nginx UI Authentication Bypass via Unauthenticated MCP

CWE-306

Timeline of Nginx UI Authentication Bypass via Unauthenticated MCP

  • Pluto Security reports the vulnerability to maintainer 0xJacky via GitHub Private Vulnerability Reporting on the 0xJacky/nginx-ui repository.
  • Yotam Perkal (yotampe-pluto) of Pluto Security discovers the unauthenticated /mcp_message endpoint while auditing MCP integrations in open-source tooling.
  • Maintainer 0xJacky commits the fix adding middleware.AuthRequired() to the /mcp_message route in mcp/router.go, together with a regression test asserting both endpoints return HTTP 403 without authentication.
  • nginx-ui v2.3.4 released on GitHub and Docker Hub containing the authentication fix.
  • GitHub Security Advisory GHSA-h6c2-x2m2-mwhf 'Unauthenticated MCP Endpoint Allows Remote Nginx Takeover' published with critical severity and CVSS 9.8.
  • CVE-2026-33032 assigned and published in NVD with CWE-306 (Missing Authentication for Critical Function).
  • Recorded Future confirms opportunistic in-the-wild exploitation targeting internet-exposed nginx-ui instances on default port 9000.
  • nginx-ui v2.3.6 released, adding WebSocketTrustedOrigins configuration and standardized WebSocket origin validation middleware on top of the MCP fix.
  • VulnCheck adds CVE-2026-33032 to its Known Exploited Vulnerabilities catalog based on confirmed mass exploitation.
  • NVD last-modified date updated with additional references and CWE confirmation.
  • Pluto Security publishes the full technical writeup including proof-of-concept; SentinelOne highlights the vulnerability in its weekly roundup citing ~2,600 exposed instances.
  • As of 2026-05-29, CVE-2026-33032 (nginx-ui "MCPwn", CVSS 9.8) remains an active live threat: it is patched in v2.3.4/v2.3.6 but is in VulnCheck KEV with a public PoC/scanner and ~2,600 internet-exposed unpatched instances under ongoing opportunistic exploitation. No successor CVE supersedes it; vendors still issue "update now" advisories.

Sources cited for Nginx UI Authentication Bypass via Unauthenticated MCP

Threats related to Nginx UI Authentication Bypass via Unauthenticated MCP

Detection coverage for TL-2026-0388

As of 2026-04-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0388 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats