Nginx UI’s MCP Endpoint Opens Full Server Takeover
The problem is not just a missing login check. nginx-ui’s MCP message endpoint was effectively open, so any network attacker could change Nginx behavior, reload configs, and take over the service through a management feature that was supposed to extend control, not remove it.
The flaw is CVE-2026-33032, a CVSS 9.8 authentication bypass in nginx-ui’s /mcp_message endpoint. Sources say version 2.3.4 fixes it, and exploitation is already in the wild. Pluto Security reported more than 2,600 internet-exposed instances, and the tool has seen more than 430,000 Docker pulls.
The risk is broader than one server restart. Once an attacker can write configs, they can intercept traffic, harvest admin credentials, and keep control through the management plane even if the original access path is closed.