Nginx UI Authentication Bypass via Unauthenticated MCP Endpoint (CVE-2026-33032) — Threadlinqs Intelligence
As of 2026-05-30, Nginx UI Authentication Bypass via Unauthenticated MCP Endpoint (CVE-2026-33032) is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0388 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
Nginx UI (0xJacky/nginx-ui) ships an unauthenticated Model Context Protocol (MCP) Server-Sent Events endpoint at /mcp_message that lets any network-reachable attacker invoke 12 MCP tools — including
CVE-2026-33032 is a critical authentication bypass (CWE-306: Missing Authentication for Critical Function) in nginx-ui, a popular web-based Nginx management tool with 11,000+ GitHub stars and 430,000+ Docker pulls. The vulnerability stems from asymmetric authentication in mcp/router.go: the GET /mcp endpoint (which opens the MCP Server-Sent Events stream) is protected by both IPWhiteList() and AuthRequired() middleware, while the POST /mcp_message endpoint (which actually dispatches MCP tool invocations) is protected only by IPWhiteList(). Both endpoints route to the same gin.Context handler mcp.ServeHTTP(c), meaning any tool exposed on /mcp is equally reachable on /mcp_message without credentials.
The IPWhiteList middleware fails open: when settings.AuthSettings.IPWhiteList is empty (the default), the check evaluates len(list) == 0 and calls c.Next() — granting access to any source address. The node_secret query parameter that gates /mcp SSE connections is also not validated on /mcp_message. A remote unauthenticated attacker therefore only needs: (1) one connection to GET /mcp?node_secret=anything to obtain a sessionId, then (2) POST /mcp_message?sessionId=<id> with any valid JSON-RPC MCP tool call. On many deployments step 1 can also be executed without the node_secret thanks to the same empty-whitelist default.
The MCP interface exposes 12 tools, with seven offering direct destructive capability: nginx_config_add (creates a config file and auto-reloads nginx), nginx_config_modify, nginx_config_enable, nginx_config_disable, nginx_config_rename, nginx_config_mkdir, reload_nginx, and restart_nginx. Five reconnaissance tools — nginx_config_get, nginx_config_list, nginx_config_base_path, nginx_config_history, and nginx_status — allow full topology disclosure. Because nginx-ui runs as the privileged process managing the nginx binary, successful exploitation yields complete takeover of the proxy tier: attackers can inject a rogue server block to hijack TLS-terminated traffic, add a log_format directive that captures Authorization headers, extract JwtSecret to forge admin tokens, chain to backend services through the compromised reverse proxy, or corrupt the configuration to cause service-wide DoS.
The vulnerability was discovered by Yotam Perkal (yotampe-pluto) of Pluto Security on 2026-03-04 and reported through GitHub Private Vulnerability Reporting the same day. Maintainer 0xJacky shipped the single-line fix (adding middleware.AuthRequired() to the /mcp_message route) on 2026-03-14 and released nginx-ui v2.3.4 on 2026-03-15. GitHub Security Advisory GHSA-h6c2-x2m2-mwhf was published 2026-03-28 and CVE-2026-33032 landed in NVD on 2026-03-30. Recorded Future confirmed opportunistic exploitation in March 2026; VulnCheck added the CVE to its KEV list on 2026-04-13. As of 2026-04-17 Shodan still indexes ~2,600 unpatched instances, concentrated on cloud hosts at Alibaba Cloud, Oracle Cloud, Tencent Cloud, and DigitalOcean — with the majority listening on default TCP/9000. Administrators should upgrade immediately to v2.3.6 (which also hardens WebSocket origin validation), disable MCP entirely if unused (config key MCP.Enabled=false), or — as a stopgap — populate IPWhiteList with trusted source addresses and block TCP/9000 at the perimeter.
Target sectors: technology, cloud-hosting, e-commerce, media, small-business, education, financial, government
Target regions: Asia, North America, Europe, Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-33032, T1595, T1592, T1190, T1133, T1203, T1505, T1098, T1068, T1078, T1556