GHSA-VC32-4GWF-77XP Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...

nginx-ui CVE-2026-33032 MCPwn detection

Non-destructive detector for CVE-2026-33032 MCPwn: missing AuthRequired on nginx-ui /mcpmessage. Fingerprints nginx-ui, obtains an unauthenticated MCP sessionID via /mcp SSE, then sends benign tools/list JSON-RPC to /mcpmessage. Never invokes destructive MCP tools. Affected builds prior to the...

Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui

CVE-2026-33032 Scanner Non-destructive vulnerability scanne...

CVE-2026-33032: Missing Authentication for Critical Function

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP Model Context Protocol integration exposes two HTTP endpoints: /mcp and /mcpmessage. While /mcp requires both IP whitelisting and authentication AuthRequired middleware, the /mcpmessage endpoi...