Chronicle/Attacks & incidents

MCPwn: unauthenticated MCP endpoint in nginx-ui exploited in the wild (CVE-2026-33032)

Apr 15, 2026AttackVulnerability disclosureSignificance assistant-drafted

Pluto Security found that nginx-ui's MCP integration left a message endpoint effectively unauthenticated under default settings, letting anyone reach its administrative MCP tools and take over the web server. The flaw (CVSS 9.8) was fixed in version 2.3.4 on 2026-03-15, and Recorded Future listed it among actively exploited vulnerabilities in March 2026.

Why it matters

It is an early case of an MCP interface itself being exploited in the wild as a server-takeover path.

Key facts

As stated in the sources, with where to find them.

Shodan data cited identified about 2,689 exposed instances.Article body
Fixed in nginx-ui 2.3.4, released 2026-03-15.Article body

Findings that cite this record

Apr 15, 2026

An MCP endpoint exposed without authentication has been reported as exploited in the wild.

Reportedreported1 evidence record

Sources

MCP Bug in Nginx: Critical CVSS 9.8 Security VulnerabilityPluto SecurityApr 15, 2026Primary sourceAccessed Sep 26, 2026
GHSA-h6c2-x2m2-mwhf (CVE-2026-33032)nginx-ui (GitHub security advisory)Mar 28, 2026Primary sourceAccessed Sep 26, 2026
Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server TakeoverThe Hacker NewsApr 15, 2026Secondary sourceAccessed Sep 25, 2026

Related records

May 20, 2026

NSA AI Security Center publishes security design considerations for Model Context Protocol deployments

PolicyGuidanceNSA Artificial Intelligence Security Center

Feb 17, 2026

NIST CAISI launches AI Agent Standards Initiative on interoperability, security and identity

PolicyProgramUS Center for AI Standards and Innovation, NIST, National Science Foundation

Sep 11, 2026

Australia's ASD issues guidance on securing agentic AI harnesses, the layer around the model

PolicyGuidanceAustralian Signals Directorate (ACSC)

Sep 30, 2025

MITRE ATLAS 5.0 adds AI agent techniques such as context poisoning and exfiltration via tool invocation

PolicyStandardMITRE

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Jul 8, 2025

General Analysis shows Supabase MCP with service-role access leaking tables via a support ticket

AttackVulnerability disclosureGeneral Analysis, Supabase

Organizations: Pluto Security, Recorded Future, nginx-ui project
Topics: Tools & MCP
Attack surface: Tools & MCP Credentials
Record: nginx-ui-mcpwn-cve-2026-33032-2026 · added 2026-09-25

Cite this record

Fide AI. "MCPwn: unauthenticated MCP endpoint in nginx-ui exploited in the wild (CVE-2026-33032)." Agentic Cyber Explorer, record nginx-ui-mcpwn-cve-2026-33032-2026. https://agentic-cyber-explorer.pages.dev/events/nginx-ui-mcpwn-cve-2026-33032-2026/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-nginx-ui-mcpwn-cve-2026-33032-2026,
  author = {{Fide AI}},
  title = {MCPwn: unauthenticated MCP endpoint in nginx-ui exploited in the wild (CVE-2026-33032)},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/nginx-ui-mcpwn-cve-2026-33032-2026/},
  note = {Record nginx-ui-mcpwn-cve-2026-33032-2026; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.