# nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)

- **Severity:** Critical
- **Signature ID:** `31bb14ab-3acf-4a23-b00f-2aa2053abfea`
- **CVEs:** CVE-2026-33032
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), ASI06 (Goal and Instruction Manipulation), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

nginx-ui, a web UI for managing nginx, ships an MCP server endpoint that can execute system commands, reload nginx, and rewrite configuration files. That endpoint does not require authentication, so anyone who can reach it over the network can run commands on the host.

## How the attack works

An attacker finds an nginx-ui instance exposed on the network and connects directly to its MCP endpoint. They call MCP tools such as nginx_command_execute or nginx_reload without sending any Authorization header, because none is required. These calls let them execute arbitrary shell commands, restart or reload nginx, and overwrite configuration files. Because the endpoint accepts unauthenticated tool calls, no credentials or prior access are needed to reach OS-level command execution.

## Why it matters

An unauthenticated attacker can gain command execution on the host running nginx-ui, letting them read or modify server configuration, disrupt the web server, and pivot to other systems reachable from that host.

## What you can do

- Restrict network access to the nginx-ui MCP endpoint to trusted hosts only, e.g. via firewall rules or a VPN.
- Check whether your nginx-ui version requires authentication on the MCP endpoint by default; if not, add an authentication layer or reverse-proxy auth in front of it.
- Audit logs for MCP tool calls (especially nginx_command_execute, nginx_reload) that arrive without an Authorization header.
- Disable or remove the MCP endpoint if you do not actively use it.

## Known benign look-alikes

- Internal-only nginx-ui deployments accessible solely over authenticated VPN where the MCP endpoint is intentionally gated by perimeter auth.
- Security scanning tooling that probes the nginx-ui MCP endpoint to detect CVE-2026-33032 exposure.
- Educational documentation describing the nginx-ui MCP architecture.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00536
- https://nvd.nist.gov/vuln/detail/CVE-2026-33032

---
Source: https://www.netzilo.com/threats/atr-nginx-ui-mcp-endpoint-unauthenticated-command-execution-cve