CVE-2026-33032
Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
- Published
- Mar 30, 2026
- Updated
- Apr 16, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 24, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 84.6%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.
Sources
- Nginx UI - Broken Access ControlTemplate
http/cves/2026/CVE-2026-33032.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
- CVE-2026-33032Detection
One missing function call on the route registration was enough to turn the MCP interface into an unauthenticated RCE gateway.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.