Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover

A recently disclosed critical security flaw impacting nginx-ui, an open-source, web-based Nginx management tool, has come under active exploitation in the wild.

The vulnerability in question is CVE-2026-33032 (CVSS score: 9.8), an authentication bypass vulnerability that enables threat actors to seize control of the Nginx service. It has been codenamed MCPwn by Pluto Security.

Attack Mechanism via MCP Protocol

According to an advisory released by nginx-ui maintainers, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message.

While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting. Crucially, the default IP whitelist is empty, which the middleware treats as "allow all."

Pluto Security researcher Yotam Perkal, who identified the flaw, stated that the attack can facilitate a full takeover in seconds via two simple requests:

1. An HTTP GET request to the /mcp endpoint to establish a session and obtain a session ID.
2. An HTTP POST request to the /mcp_message endpoint using the session ID to invoke any MCP tool without authentication.

Severe Impact on Servers

Successful exploitation of this flaw enables attackers to perform high-level administrative actions without credentials, including:

• Restarting the Nginx service.
• Creating, modifying, or deleting Nginx configuration files.
• Triggering automatic configuration reloads.
• Intercepting traffic and harvesting administrator credentials.

"When you bolt MCP onto an existing application, the MCP endpoints inherit the application’s full capabilities but not necessarily its security controls. The result is a backdoor that bypasses every authentication mechanism the application was carefully built with," Perkal noted.

Exploitation Status and Remediation

Data from Shodan shows approximately 2,689 exposed instances on the internet, primarily located in China, the U.S., Indonesia, Germany, and Hong Kong. Recorded Future has listed CVE-2026-33032 as one of the 31 vulnerabilities actively exploited by threat actors in March 2026.

The vulnerability was addressed in version 2.3.4, released on March 15, 2026.

Emergency Recommendations:

• Update Immediately: Upgrade to version 2.3.4 or later.
• Manual Fix: Add middleware.AuthRequired() to the /mcp_message endpoint to force authentication.
• IP Whitelist Configuration: Change the IP allowlisting default behavior from "allow-all" to "deny-all."
• Interim Measure: Disable MCP functionality and restrict network access to the management interface.

The news of MCPwn follows the discovery of similar flaws (MCPwnfluence) in the Atlassian MCP server, highlighting a growing trend of attackers targeting insecure MCP implementations to achieve remote code execution (RCE).