Home / Vulnerability Intelligence / CVE-2026-33032

CVE-2026-33032 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 30, 2026

Nginx UI - Broken Access Control

Published: March 30, 2026Updated: March 30, 2026Remote Exploitable

Overview

Nginx UI <= 2.3.5 contains a broken access control vulnerability caused by missing authentication on /mcp_message endpoint with empty IP whitelist, letting network attackers fully control nginx service remotely, exploit requires network access.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover.

Mitigation

Update to the latest version when available.

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 30, 2026

🔴 CVE-2026-33032 - Critical (9.8) Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentic... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33032/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 30, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-33032
Severity: Critical
CVSS Score: 9.8
Type: broken_access_control
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-306

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days