An open-source, web-based Nginx administration application called nginx-ui has a recently discovered major security weakness that is being actively exploited in the wild.
The vulnerability in question is CVE-2026-33032 (CVSS score: 9.8), which allows threat actors to take over the Nginx service using an authentication bypass. Pluto Security has given it the code name MCPwn.
An advisory published by nginx-ui maintainers last month states that two HTTP endpoints are exposed by the nginx-ui MCP (Model Context Protocol) integration: /mcp and /mcp_message. The /mcp_message endpoint simply applies IP whitelisting, and the default IP whitelist is empty, which the middleware interprets as “allow all,” but /mcp requires both IP whitelisting and authentication (AuthRequired() middleware).
This implies that any network attacker can use all MCP tools—including restarting nginx, generating, editing, and removing nginx configuration files read more about Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.