Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover

Summary: CVE-2026-33032, a CVSS 9.8 authentication bypass in the open-source nginx-ui management tool, is under active exploitation; its /mcp_message endpoint applies only IP whitelisting, and the default empty whitelist is treated as 'allow all.' Pluto Security researcher Yotam Perkal, who reported the flaw and codenamed it MCPwn, said a full takeover takes two requests in seconds, chaining a separate flaw (CVE-2026-27944) that exposes backup encryption keys via /api/backup to extract a node_secret used to authenticate the MCP interface; nginx-ui 2.3.4, released March 15, 2026, fixes it.
What you should know: Shodan shows roughly 2,689 nginx-ui instances exposed on the internet, and Recorded Future lists this among 31 vulnerabilities actively exploited in March 2026 - so unpatched deployments are reachable now, not hypothetically.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2026-27944 CVE-2026-33032
Related: ⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More Cyber Risks ·
⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More Cyber Risks ·
At The Edge Clear: July 13 - 20, 2026 Cyber Risks ·