Nginx UI - Broken Access Control

criticalseverity

9.8CVSS score

35.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover.

Impact

An unauthenticated attacker with a valid MCP session ID can inject arbitrary nginx configurations,create reverse proxies for credential theft, and achieve remote code execution via nginx config primitives.

Fix

Upgrade to nginx-ui v2.3.4 or later which adds AuthRequired() to /mcp_message.

How to confirm it

Send: POST /mcp_message
Positive when: contains "{\"jsonrpc\":" and "\"message\":" and "\"id\":" AND status 400

Run it with nuclei: nuclei -id CVE-2026-33032 -u <target>

The full check

id: CVE-2026-33032

info:
  name: Nginx UI - Broken Access Control
  author: DhiyaneshDk
  severity: critical
  description: |
    Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover.
  impact: |
    An unauthenticated attacker with a valid MCP session ID can inject arbitrary nginx configurations,create reverse proxies for credential theft, and achieve remote code execution via nginx config primitives.
  remediation: Upgrade to nginx-ui v2.3.4 or later which adds AuthRequired() to /mcp_message.
  reference:
    - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf
    - https://github.com/0xJacky/nginx-ui/commit/413dc631
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33032
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-33032
    epss-score: 0.35273
    epss-percentile: 0.98458
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    product: nginx-ui
    shodan-query: http.title:"Nginx UI"
    fofa-query: title="Nginx UI"
  tags: cve,cve2026,nginx-ui,mcp,unauth,misconfig,vkev

variables:
  string: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /mcp_message HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"{{string}}","version":"1.0"}},"id":1}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"jsonrpc":'
          - '"message":'
          - '"id":'
        condition: and

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from