CVE-2026-33032

The MCP (Model Context Protocol) integration in Nginx UI exposes two HTTP endpoints: /mcp and /mcp_message. The /mcp endpoint requires both IP whitelisting and authentication (AuthRequired() middleware), while /mcp_message applies only IP whitelisting. Since the default list of allowed IP addresses is empty, the middleware treats this state as 'allow all'. As a result, any network attacker can call all MCP tools without authentication, including restarting Nginx, creating, modifying and deleting configuration files, and forcing their reload.

An attacker without any privileges can completely take over the Nginx service — modify its configuration, destroy configuration files or cause service unavailability (DoS). Manipulation of network traffic handled by the Nginx server is also possible.

At the time of CVE publication there are no publicly available patches. You should monitor the vendor's repository at https://github.com/0xJacky/nginx-ui and apply available updates immediately upon release. Until a patch becomes available, it is recommended to restrict network access to the /mcp and /mcp_message endpoints using external access control mechanisms (e.g., firewall, reverse proxy with enforced authentication) or disable MCP integration if not required.

Nginx UI versions 2.3.5 and earlier with MCP integration enabled