Critical alert: nginx-ui allows you to take full control of Nginx without credentials (CVE-2026-33032)

A critical vulnerability in the Nginx management web component known as nginx-ui - specifically in its support of the Model Context Protocol (MCP) protocol - is being exploited in nature and allows the full taking of the web service without authentication. In simple terms: an interface designed to facilitate administration can become an open door for a remote attacker to rewrite the configuration and have Nginx run malicious instructions.

The problem is that the endpoint / mcp _ message was accessible without protection, which allows an attacker to invoke privileged actions of the MCP protocol without credentials. According to the official entry into the NIST vulnerability database, this includes the ability to restart Nginx, create or modify configuration files and force automatic recharges, operations that together allow to fully control the web server ( CVE-2026-33032 in NVD).

Project managers quickly published corrections: an update was released at the beginning of March and public technical descriptions and concept tests have since appeared to show how to exploit the failure. Researchers from the Pluto Security group documented the operating vector and published a technical report with demonstrations, in addition to reporting the incidence initially ( analysis and demo of Pluto Security).

The exploitation does not require prior privileges. According to the analysis of Pluto Security, it is enough to have network access to the service: the attacker establishes a SSE (Server-Sent Events) connection to open an MCP session and, using the returned session identifier, sends requests to the endpoint / mcp _ message. This allows you to run internal MCP calls without authentication, read configuration files, inject new server blocks and force Nginx recharges for malicious changes to come into effect.

The magnitude of the risk is clear if the project's popularity is addressed: nginx-ui accumulates tens of thousands of stars in GitHub and hundreds of thousands of downloads in Docker, which translates into a significant presence on the Internet. Internet Scanning by Pluto Security with Shodan identified about 2,600 publicly accessible instances that could be affected, with greater concentration in China, the United States, Indonesia, Germany and Hong Kong ( scan details).

In addition to Pluto's technical report, threat intelligence companies have pointed to the active exploitation of the defect. A recent review of the CVE landscape by Recorded Future includes this vulnerability among those observed in use by attackers, which underlines the need for immediate action by security administrators and teams ( CVE Landscape - Recorded Future).

What can an attacker do with access to / mcp _ message? Although it is not appropriate to enter into step-by-step operating instructions, it is important to understand the scope: the attacker can read the Nginx configuration to discover internal routes or exposed credentials, write new server blocks that redirect traffic or load malicious content, and force the service recharge to activate these modifications. In other words, the integrity and availability of the server are compromised.

In view of this scenario, the most effective and priority recommendation is to update nginx-ui to a version that includes official correction. The most recent safe version is the 2.3.6, published in the project repository; applying it as soon as possible drastically reduces the risk of exploitation ( nginx-ui v2.3.6 - GitHub).

If for operational reasons it is not possible to update immediately, there are temporary mitigation measures that reduce the attack surface. Among the recommended actions are to restrict access to the management interface through firewall rules or access control lists so that only reliable management networks can be connected, specifically block the endpoint / mcp _ message in the perimeter, or disable nginx-ui while planning the parking. It is also prudent to audit Nginx configuration files in search of unauthorized changes and to review the log for SSE connections or unusual requests to the administration panel.

Finally, and not least, security teams must assume that the emergence of public exploits and the confirmation of attacks in nature raise the priority of the response: apply the patch, check obvious commitments, rotate credentials that might have been compromised and monitor intrusion indicators. The combination of immediate patch and access restrictions is the most effective defense against this type of failure in remote administration components.

For more technical context and references, see the NVD entry on vulnerability ( CVE-2026-33032), the report and the tests of Pluto Security ( Pluto analysis) and the summary of the CVE landscape published by Recorded Future ( Recorded Future - CVE Landscape).