Findings/exposed-mcp-endpoints-exploited

An MCP endpoint exposed without authentication has been reported as exploited in the wild.

Reportedreported1 evidence record from 1 independent sourceassistant-drafted

Scope: what this does not show

One case, from secondary sources; exploitation rests on a threat-intelligence listing with no public detail of the activity.

Reported: Stated by one source and not yet corroborated or challenged.

Evidence

Apr 15, 2026

MCPwn: unauthenticated MCP endpoint in nginx-ui exploited in the wild (CVE-2026-33032)

Pluto Security

Status history

2026-04-15ReportedMCPwn in nginx-ui reported as exploited. · record

What would change this: Scanning data on how many MCP endpoints are exposed and attacked.
Evidence kind: reported: Stated by a party without shareable evidence.
Freshness: Evidence 164d old · recheck in 201 daysNewest evidence Apr 15, 2026. Half-life 365 days.
Methods tested: Tool and MCP poisoning
Topics: Tools & MCP
Attack surface: Tools & MCP Access gate

Cite this record

Fide AI. "An MCP endpoint exposed without authentication has been reported as exploited in the wild.." Agentic Cyber Explorer, record exposed-mcp-endpoints-exploited. https://agentic-cyber-explorer.pages.dev/findings/exposed-mcp-endpoints-exploited/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-exposed-mcp-endpoints-exploited,
  author = {{Fide AI}},
  title = {An MCP endpoint exposed without authentication has been reported as exploited in the wild.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/exposed-mcp-endpoints-exploited/},
  note = {Record exposed-mcp-endpoints-exploited; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.