Nginx-ui Authentication Bypass Vulnerability CVE-2026-33032 Exploited

THE THREAT

A critical authentication bypass vulnerability impacting Nginx-ui, CVE-2026-33032 (9.8), is being actively exploited in the wild. The flaw resides in Nginx-ui's Model Context Protocol (MCP) and enables attackers in the network to gain complete control over the Ngnix service.

A Proof-of-Concept (PoC) exploit for CVE-2026-33032 is publicly available. In light of confirmed active exploitation and the existence of this PoC, organizations are strongly advised to apply the latest security updates to Nginx-ui immediately.

What we're doing about it

• eSentire's MDR for Network has detections in place to identify exploitation of CVE-2026-33032
• eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2026-33032
• eSentire's Threat Response Unit (TRU) is tracking the topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, upgrade to Ngnix-ui version 2.3.4
• If upgrading is not feasible,
  • Disable MCP until the updates are applied
  • Ensure the MCP IP whitelist contains trusted sources only
• Review Nginx logs for suspicious activities
  • conf.d/ and sites-enabled/ log files will capture any configuration changes

Additional information

Nginx-ui is a web-based interface designed for managing Nginx servers. It allows users to access Nginx logs, edit and reload server configuration files, and manage SSL certificates, among other administrative functions. Pluto Security identified CVE-2026-33032 and reported the flaw on March 4th, 2026. Following the disclosure, the vulnerability was addressed in Nginx-ui version 2.3.4, released on March 15th. The maintainers of the Nginx-ui also released an advisory for the flaw and provided the PoC along with it. Recorded Future reported that CVE-2026-33032 was exploited in March 2025.

On April 15th, Pluto Security published details on CVE-2026-33032 and dubbed the flaw as "MCPwn". The Nginx-ui MCP integration exposes two HTTP endpoints: /mcp and /mcp_message. While the /mcp endpoint enforces both IP whitelisting and authentication through the middleware, the /mcp_message endpoint only applies IP whitelisting. The whitelist is empty by default, resulting in the middleware permitting all connections. This enables an attacker in the network to access all MCP tools without authentication.

MCP is an open-source standard for connecting AI applications to external systems. The protocol is being widely integrated within the servers to enhance the AI capabilities. Pluto Security observed that, in many cases, when MCP is integrated into an application, it does not inherit the application's existing security controls, thereby leaving the application in an insecure state. Given the critical role Nginx-ui plays in managing Nginx servers, exploitation of CVE-2026-33032 could have severe consequences, including complete Nginx service takeover, configuration exfiltration, credential harvesting, service disruption, and traffic interception. Upgrading to Nginx-ui version 2.3.4 is critical to avoid a risk of potential exploitation.

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-33032
[2] https://nginxui.com/guide/about
[3] https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf
[4] https://www.recordedfuture.com/blog/march-2026-cve-landscape
[5] https://pluto.security/blog/mcp-bug-nginx-security-vulnerability-cvss-9-8/
[6] https://modelcontextprotocol.io/docs/getting-started/intro