ID:12591 - Exploit for Missing Authentication for Critical Function in nginx-ui - CVE-2026-33032

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to take control of the nginx service, disclose sensitive configuration information, and cause a denial of service.

The vulnerability exists due to missing authentication for critical functionality in the /mcp_message endpoint when handling MCP tool invocation requests. A remote attacker can send specially crafted HTTP requests to invoke MCP tools without authentication to take control of the nginx service, disclose sensitive configuration information, and cause a denial of service.

The issue occurs because /mcp_message routes to the same MCP handler as /mcp, while the default empty IP whitelist is treated as allow-all.

Remediation