CVE-2026-33032 Details
Description
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.
A vulnerability in Nginx UI versions through 2.3.5 allows unauthenticated access to the Model Context Protocol (MCP) integration via the '/mcp_message' endpoint. This endpoint, which lacks proper authentication and IP whitelisting, can be exploited by network attackers to invoke MCP tools that manipulate Nginx configuration and control the Nginx service. The vulnerability arises from an authentication oversight, where the '/mcp' endpoint requires authentication but '/mcp_message' does not, combined with an empty default IP whitelist that allows all requests.
To address this vulnerability, add authentication requirements to the '/mcp_message' route and consider changing the default IP whitelist behavior to deny all requests when unconfigured.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf | CISA-ADP | ExploitMitigationVendor Advisory |
| https://websec.net/blog/cve-2026-33032-unauthenticated-nginx-ui-mcp-takeover-69e1200f9fceb1f3fbe9c47f | CVE | |
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nginxui nginx ui | <= 2.3.5 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | CVE Modified | CVE |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | New CVE Received | [email protected] |