incident response free stock image for MCPwatch editorial use

MCPwn (CVE-2026-33032): First Confirmed In-the-Wild MCP Exploit Hits nginx-ui

by

What Happened

incident response free stock image for MCPwatch editorial use
Incident response: MCPwn exposed how a 27-character fix closes a CVSS 9.8 auth bypass in nginx-ui’s MCP integration. Source: Openverse/flickr, CC BY 2.0.

In March 2026, security researcher Yotam Perkal at Pluto Security discovered a critical authentication bypass in nginx-ui, the popular open-source web management interface for Nginx servers (11,000+ GitHub stars, 430,000+ Docker pulls). The vulnerability was assigned CVE-2026-33032 with a CVSS 9.8 severity score, and it was quickly dubbed MCPwn.

The root cause is deceptively simple: nginx-ui added Model Context Protocol (MCP) support and split it across two HTTP routes — /mcp and /mcp_message. The /mcp route correctly requires both IP whitelisting and the AuthRequired() middleware. But /mcp_message only applies IP whitelisting — and the default IP whitelist is empty. The result: an unauthenticated remote attacker can send any MCP message to a publicly reachable nginx-ui instance and assume full administrative control over the managed Nginx server.

According to NVD, the vulnerability affects nginx-ui versions 2.3.5 and prior. The NVD entry classifies it under CWE-306: Missing Authentication for Critical Function.

The fix? Literally 27 characters of code — adding the missing AuthRequired() middleware call to the /mcp_message route. The maintainer (0xJacky) shipped a patch within one day of the report, and version 2.3.4 was released on March 15, 2026.

Why It Matters for MCP and Agent Endpoints

MCPwn is significant for several reasons that reach far beyond nginx-ui itself:

1. MCP endpoints are now a proven attack surface

This is not a theoretical concern. An MCP integration endpoint — the exact type of endpoint that AI agents and tool servers expose — was the single point of failure that handed attackers full server control. As organizations adopt MCP for AI agent communication, every MCP endpoint becomes a potential authentication gate that must be audited.

2. Active exploitation was confirmed

The Hacker News and Rapid7 both confirmed active exploitation in the wild. Decryption Digest identified 2,689 exposed nginx-ui instances reachable without authentication. Attackers were observed using the MCP endpoint to modify Nginx configurations, install reverse shells, and pivot into internal networks.

3. The 27-character fix reveals a pattern

MCPwn mirrors a broader problem across the MCP ecosystem: MCP integrations are being bolted on to existing applications without consistent security middleware. When a framework adds an MCP route as a “second transport” alongside an existing authenticated API, it is dangerously easy to forget the auth middleware on the new route. This is the same structural weakness identified in the n8n and Flowise CVE batches, where MCP endpoints were the least-secured paths into otherwise hardened platforms.

4. The Cloud Security Alliance issued a formal research note

The Cloud Security Alliance (CSA) published a research note classifying CVE-2026-33032 under CWE-306 and warning that the pattern — missing authentication on MCP endpoints — is likely to recur across the ecosystem.

Practical Defensive Takeaways

  1. Upgrade nginx-ui immediately to version 2.3.4 or later. The fix is minimal but critical. If you cannot upgrade, block external access to the /mcp and /mcp_message endpoints at the network level.
  2. Audit every MCP endpoint for authentication — not just the primary /mcp route. Check all HTTP routes that handle MCP messages, SSE streams, or tool invocations. Verify that auth middleware is applied consistently to every route, not just the “main” one.
  3. Review IP whitelists. A default-empty IP whitelist that does not deny all traffic when empty is a dangerous default. Ensure your MCP endpoint access control explicitly denies by default.
  4. Scan for exposed nginx-ui instances. Use http.title:"nginx-ui" in Shodan or Censys to identify instances in your organization’s IP space. Apply network segmentation to keep MCP management interfaces off the public internet.
  5. Apply the OWASP MCP Security Cheat Sheet to all MCP integrations. The cheat sheet explicitly recommends authentication middleware on every MCP route, input validation on tool parameters, and network-level restrictions for MCP servers.

What Teams Should Check Next

  • Check nginx-ui version: Run nginx-ui -v or check your container image tag. Anything below v2.3.4 is vulnerable.
  • Search access logs for POST requests to /mcp_message from unauthenticated IPs. This is the primary exploitation path.
  • Audit other MCP integrations in your stack — n8n, Flowise, custom MCP gateways — for the same missing-auth pattern. See MCPwatch’s CVE Watch and Incidents pages for related advisories.
  • Review the MCP CVE Project for a comprehensive index of all MCP-related vulnerabilities disclosed to date.
  • Validate MCP endpoint access in your firewall rules and reverse proxy configurations. Ensure no MCP routes are exposed without authentication, rate limiting, and TLS.

Sources

Leave a Comment