CVE-2026-33032 - Vulnerability Analysis

Overview

Nginx UI <= 2.3.5 contains a broken access control vulnerability caused by missing authentication on /mcp_message endpoint with empty IP whitelist, letting network attackers fully control nginx service remotely, exploit requires network access.

Severity & Score

Impact

Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover.

Mitigation

Update to the latest version when available.

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf

Social Media Activity(1 post)

HackMag — Top-notch cybersecurity magazine

@hackmag

Apr 20, 2026

⚪️ Critical Vulnerability in Nginx UI Allows Full Server Takeover 🗨️ Information security researchers have warned that a critical vulnerability in the popular Nginx web server management tool (nginx-ui) is being actively exploited by attackers and allows for complete server takeover. The issue has been assigned the identifier CVE-2026-33032 (9.8 on… 🔗 https://hackmag.com/news/nginx-ui?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials #news

View original post

GitHub Repositories(3 repos)

• https://github.com/Shreda/CVE-2026-33032-nginx-ui-vuln-lab
• https://github.com/keraattin/CVE-2026-33032
• https://github.com/Twinson333/cve-2026-33032-scanner

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner