SB2026041626 - Multiple vulnerabilities in nginx-ui
Published: April 16, 2026 Updated: July 17, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-33032)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to take control of the nginx service, disclose sensitive configuration information, and cause a denial of service.
The vulnerability exists due to missing authentication for critical functionality in the /mcp_message endpoint when handling MCP tool invocation requests. A remote attacker can send specially crafted HTTP requests to invoke MCP tools without authentication to take control of the nginx service, disclose sensitive configuration information, and cause a denial of service.
The issue occurs because /mcp_message routes to the same MCP handler as /mcp, while the default empty IP whitelist is treated as allow-all.
2) Missing Authentication for Critical Function (CVE-ID: CVE-2026-42222)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to take over the initial installation and gain administrative control of the instance.
The vulnerability exists due to improper access control in the POST /api/install endpoint when handling bootstrap requests during first-run setup. A remote attacker can submit attacker-controlled bootstrap data to take over the initial installation and gain administrative control of the instance.
Exploitation is possible only while the instance is still uninitialized and within the initial 10-minute setup window.
Remediation
Install update from vendor's website.