Nginx

If you’re running nginx-ui with Model Context Protocol (MCP) support and haven’t patched yet, stop what you’re doing. A critical vulnerability — CVE-2026-33032 — is being actively exploited in the wild right now, and the attack is devastatingly simple. What Is CVE-2026-33032? CVE-2026-33032 is an authentication bypass flaw in nginx-ui’s MCP endpoint with a CVSS score of 9.8 (Critical). The vulnerability exists because nginx-ui leaves its /mcp_message endpoint completely unprotected. No authentication required. No credentials needed. Just two unauthenticated HTTP requests and an attacker has full control of your nginx server. ...

CVE-2026-33032 is a CVSS 9.8 authentication bypass in nginx-ui’s Model Context Protocol (MCP) endpoint, actively exploited in the wild right now. This guide walks you through checking your exposure, assessing impact, and patching — in that order. Time to complete: 10–20 minutes Risk if you skip: Full nginx server takeover without authentication Patched version: nginx-ui 2.3.4+ Step 1: Check Your nginx-ui Version nginx-ui --version Or check the installed package version: ...