# Nginx UI Authentication Bypass via Unauthenticated MCP Endpoint (CVE-2026-33032)

> Nginx UI (0xJacky/nginx-ui) ships an unauthenticated Model Context Protocol (MCP) Server-Sent Events endpoint at /mcp_message that lets any network-reachable attacker invoke 12 MCP tools — including nginx_config_add, nginx_config_modify, and reload_nginx — to rewrite web server configurations and hijack proxied traffic. Approximately 2,600 publicly exposed instances (default TCP/9000) are reachable on the internet, with active in-the-wild exploitation confirmed by Recorded Future and VulnCheck. Patched in v2.3.4 (with further hardening in v2.3.6); CVSS 9.8 critical.

- **Published:** 2026-04-17T12:00:00Z
- **Last reviewed:** 2026-04-17T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0388
- **ID:** TL-2026-0388
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33032

## Description

CVE-2026-33032 is a critical authentication bypass (CWE-306: Missing Authentication for Critical Function) in nginx-ui, a popular web-based Nginx management tool with 11,000+ GitHub stars and 430,000+ Docker pulls. The vulnerability stems from asymmetric authentication in mcp/router.go: the GET /mcp endpoint (which opens the MCP Server-Sent Events stream) is protected by both IPWhiteList() and AuthRequired() middleware, while the POST /mcp_message endpoint (which actually dispatches MCP tool invocations) is protected only by IPWhiteList(). Both endpoints route to the same gin.Context handler mcp.ServeHTTP(c), meaning any tool exposed on /mcp is equally reachable on /mcp_message without credentials.

The IPWhiteList middleware fails open: when settings.AuthSettings.IPWhiteList is empty (the default), the check evaluates len(list) == 0 and calls c.Next() — granting access to any source address. The node_secret query parameter that gates /mcp SSE connections is also not validated on /mcp_message. A remote unauthenticated attacker therefore only needs: (1) one connection to GET /mcp?node_secret=anything to obtain a sessionId, then (2) POST /mcp_message?sessionId=<id> with any valid JSON-RPC MCP tool call. On many deployments step 1 can also be executed without the node_secret thanks to the same empty-whitelist default.

The MCP interface exposes 12 tools, with seven offering direct destructive capability: nginx_config_add (creates a config file and auto-reloads nginx), nginx_config_modify, nginx_config_enable, nginx_config_disable, nginx_config_rename, nginx_config_mkdir, reload_nginx, and restart_nginx. Five reconnaissance tools — nginx_config_get, nginx_config_list, nginx_config_base_path, nginx_config_history, and nginx_status — allow full topology disclosure. Because nginx-ui runs as the privileged process managing the nginx binary, successful exploitation yields complete takeover of the proxy tier: attackers can inject a rogue server block to hijack TLS-terminated traffic, add a log_format directive that captures Authorization headers, extract JwtSecret to forge admin tokens, chain to backend services through the compromised reverse proxy, or corrupt the configuration to cause service-wide DoS.

The vulnerability was discovered by Yotam Perkal (yotampe-pluto) of Pluto Security on 2026-03-04 and reported through GitHub Private Vulnerability Reporting the same day. Maintainer 0xJacky shipped the single-line fix (adding middleware.AuthRequired() to the /mcp_message route) on 2026-03-14 and released nginx-ui v2.3.4 on 2026-03-15. GitHub Security Advisory GHSA-h6c2-x2m2-mwhf was published 2026-03-28 and CVE-2026-33032 landed in NVD on 2026-03-30. Recorded Future confirmed opportunistic exploitation in March 2026; VulnCheck added the CVE to its KEV list on 2026-04-13. As of 2026-04-17 Shodan still indexes ~2,600 unpatched instances, concentrated on cloud hosts at Alibaba Cloud, Oracle Cloud, Tencent Cloud, and DigitalOcean — with the majority listening on default TCP/9000. Administrators should upgrade immediately to v2.3.6 (which also hardens WebSocket origin validation), disable MCP entirely if unused (config key MCP.Enabled=false), or — as a stopgap — populate IPWhiteList with trusted source addresses and block TCP/9000 at the perimeter.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1556 Modify Authentication Process
- T1070 Indicator Removal
- T1557 Adversary-in-the-Middle
- T1552 Unsecured Credentials
- T1606 Forge Web Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1602 Data from Configuration Repository
- T1005 Data from Local System
- T1090 Proxy
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1498 Network Denial of Service
- T1489 Service Stop

## Sources

- [Pluto Security — Nginx UI MCP Authentication Bypass (CVSS 9.8)](https://pluto.security/blog/mcp-bug-nginx-security-vulnerability-cvss-9-8/)
- [SentinelOne — The Good, the Bad and the Ugly Week 16](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-16-7/)
- [NVD — CVE-2026-33032](https://nvd.nist.gov/vuln/detail/CVE-2026-33032)
- [GitHub Security Advisory GHSA-h6c2-x2m2-mwhf — Unauthenticated MCP Endpoint Allows Remote Nginx Takeover](https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf)
- [0xJacky/nginx-ui GitHub Repository](https://github.com/0xJacky/nginx-ui)
- [nginx-ui v2.3.4 Release Notes](https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4)
- [nginx-ui v2.3.6 Release Notes](https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.6)
- [VulnCheck Known Exploited Vulnerabilities Catalog](https://vulncheck.com/kev)
- [Model Context Protocol Specification](https://modelcontextprotocol.io/specification)
- [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0388