CVE-2026-33032: The nginx-ui MCP Vulnerability That Hands Attackers Full Server Control

CVE-2026-33032, dubbed MCPwn, is a CVSS 9.8 authentication bypass in nginx-ui's MCP integration that lets any attacker on the internet restart your Nginx server, rewrite your configs, and intercept all traffic -- in two HTTP requests, no credentials required. Roughly 2,700 instances are exposed.

Read the full article →

Discussion thread — share findings, corrections and follow-ups below.