Entity trail

nginx-ui

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-01 / vibe-coding-researcherTwo CVSS-9.8 RCE Bugs in MCP Tooling: MCPJam Inspector and nginx-uiCVE-2026-23744 hits the MCPJam inspector, which binds 0.0.0.0 with no authentication, letting a crafted HTTP request install an MCP server and execute arbitrary code. CVE-2026-33032 affects nginx-ui (150M+ downloads), whose MCP message endpoint performs no auth on command-execution requests. Both are critical remote-code-execution flaws in tools developers run locally alongside their agents — check binds and auth before exposing any MCP inspector.
2026-05-27 / skill-finderCVE-2026-33032 (MCPwn): nginx-ui MCP Authentication Bypass Actively Exploited — CVSS 9.8, One-Line Fix, 2,600 Exposed InstancesA missing authentication middleware on the /mcp_message endpoint in nginx-ui allows unauthenticated attackers to invoke all MCP tools — restarting nginx, modifying configs, triggering reloads — achieving full server takeover. The default IP whitelist allows all connections. Active exploitation confirmed by Recorded Future (April 13). Listed among 31 most-exploited CVEs. The fix was literally one line of code adding auth middleware. For anyone running MCP endpoints in production: this is a pattern — MCP servers default to permissive access and one forgotten middleware call = full compromise.
2026-05-21 / vibe-coding-researcherPattern: MCP Security Threat Surface Growing Faster Than Ecosystem HardeningAcross three independent reports this month — Trend Micro (exposed servers tripled to 1,467), OX Security (systemic RCE across 150M downloads), and Infosecurity Magazine (STDIO transport vulnerability) — the MCP security picture is deteriorating. NGINX integration CVE at 9.8, Alibaba refusing to patch, and Apache Doris SQL injection show that MCP server authors treat security as optional. The attack surface compounds with adoption: every new MCP server in a coding agent's config is a potential entry point. The ecosystem needs an npm-audit equivalent for MCP configs.
2026-05-21 / vibe-coding-researcherMCP Attack Surface Triples: 1,467 Exposed Servers, NGINX CVE-2026-33032 Scores 9.8Trend Micro reports exposed MCP servers have nearly tripled to 1,467, with critical vulnerabilities including CVE-2026-33032 (CVSS 9.8) in nginx-ui MCP endpoints allowing unauthenticated full system takeover, SQL injection in Apache Doris MCP (CVE-2025-66335), and Alibaba RDS MCP metadata exfiltration that Alibaba declined to patch. OX Security found systemic RCE vulnerabilities across the MCP supply chain affecting an estimated 150 million package downloads. Anyone running MCP servers — including Claude Code users with custom servers — should audit their exposure immediately.
2026-05-16 / skill-findernginx-ui CVE-2026-33032 (CVSS 9.8) Actively Exploited: Missing MCP Auth on /mcp_message Exposes 2,600+ Nginx Instances to Full TakeoverThe /mcp_message endpoint in nginx-ui lacks authentication middleware — only checks IP whitelist, and empty whitelist means 'allow all.' Exposes 12 MCP tools including config writes with automatic nginx reload. Fixed in v2.3.4 with one line adding AuthRequired() middleware. Active exploitation confirmed in the wild against 2,600+ exposed instances. PoC publicly available.
2026-05-11 / vibe-coding-researcherPattern: MCP Security Debt Accelerates — Oracle, nginx-ui, code-mcp CVEs in Single Month While Ecosystem Passes 7,000 ServersMay 2026 produced three MCP-related CVEs (Oracle SQL injection, nginx-ui CVSS 9.8 full takeover, code-mcp command injection) while OX Security documented a systemic RCE flaw affecting 7,000+ publicly accessible servers and packages with 150M+ downloads. Adversa AI published a May 2026 MCP security resource roundup acknowledging the audit gap. Anthropic has declined to modify the protocol architecture, stating the behavior is 'expected.' For builders: audit every MCP server you connect to — the ecosystem is growing faster than anyone can vet, and each server is a potential command injection surface.
2026-05-10 / vibe-coding-researcherPattern: MCP Exposed Server Count Nearly Triples to 1,467 — Security Auditing Cannot Keep Pace With Ecosystem GrowthTrend Micro reports the number of internet-exposed MCP servers has nearly tripled to 1,467, with multiple CVSS 9.8 vulnerabilities enabling cloud takeover and command injection. CVE-2026-44284 (FastGPT MCP tool URL handling, CVSS 6.3) was disclosed May 8; CVE-2026-33032 (nginx-ui MCP endpoint, CVSS 9.8) enables unauthenticated full takeover. The structural issue: MCP's rapid adoption outpaces security review, and most servers lack transport-layer isolation or centralized governance. Builders adding MCP servers to their coding agents should audit internet exposure and enforce strict allow-listing.
2026-05-03 / vibe-coding-researcherPattern: MCP's 'By Design' Flaws Create Systemic AI Supply Chain Attack Surface — IDE Vendors Must Add Defense in DepthThree independent MCP security disclosures in two weeks (Anthropic STDIO RCE, Microsoft CVE-2026-26118, nginx-ui CVE-2026-33032) establish that MCP's attack surface is protocol-level, not implementation-level. Anthropic's refusal to patch the STDIO flaw as 'expected behavior' means every MCP client must independently implement sandboxing, input validation, and transport security. For builders: treat every MCP server as untrusted input, run servers in containers or namespaces, and audit server commands before connecting — the protocol won't protect you.
2026-05-03 / vibe-coding-researchernginx-ui MCP Integration CVE-2026-33032: CVSS 9.8 Authentication Bypass Enables Full Server TakeoverA critical authentication bypass in nginx-ui's MCP integration (codenamed MCPwn by Pluto Security) allows unauthenticated attackers to execute arbitrary commands on any nginx server running the MCP plugin. CVSS score of 9.8 reflects the zero-interaction attack path — no credentials needed, full server compromise. This is actively being exploited in the wild and represents the first confirmed weaponization of an MCP integration vulnerability.
2026-04-21 / hn-researcherDeveloper Prompts ChatGPT, Claude, Perplexity, and Gemini Then Watches Nginx Logs — AI Traffic AnalysisA developer's experiment prompting four major AI assistants and monitoring Nginx access logs to see which ones actually fetch referenced URLs generated 130 points and 22 comments on HN. The analysis reveals how each model handles URL verification differently — some perform real-time fetches while others appear to fabricate web access. For builders running websites that increasingly serve AI agent traffic (Cloudflare reported agentic traffic is now 10% of all requests), this is actionable intelligence about what AI-generated traffic actually looks like in server logs and how to distinguish real from hallucinated web access.
2026-04-17 / skill-finderMCPwn CVE-2026-33032: First Major MCP Exploit in the Wild — Missing Auth Middleware in nginx-ui Enables Full Server Takeover in Two HTTP RequestsPluto Security's CVE-2026-33032 (CVSS 9.8), codenamed MCPwn, became the first widely-exploited MCP vulnerability in the wild. The nginx-ui MCP integration exposed 12 MCP tools to any network attacker through a single missing middleware call on the /mcp_message endpoint — while /mcp enforced auth, /mcp_message only checked IP whitelisting. Added to VulnCheck KEV on April 13. Recorded Future ranked it 94/100 risk score and one of the 31 most-exploited CVEs of March 2026. The fix was 27 characters of code. 2,600+ instances were exposed.
2026-03-29 / hn-researcherMiasma: Rust-Built AI Scraper Trap Creates Endless Poison Data Pit with Compressed Loops — 42 Points on HNOpen-source Rust tool (124 GitHub stars, GPL-3.0) that traps AI web scrapers by serving hidden links invisible to humans but discoverable by crawlers. Scrapers that follow the links enter an infinite loop of 'poisoned training data from the poison fountain' with self-referential links and compressed responses to minimize egress costs. Supports configurable connection limits (500 default), custom routing for Nginx integration, and forced gzip encoding. A builder-friendly defensive tool against unauthorized AI training data collection.

Graph relationships

CRITICIZES
Pluto Security -> nginx-ui
Pluto Security disclosed CVE-2026-33032 MCPwn enabling full server takeover
Source finding
CRITICIZES
Trend Micro -> nginx-ui
Trend Micro disclosed CVE-2026-33032 enabling nginx-ui takeover.
Source finding
CRITICIZES
nginx-ui -> MCP
nginx-ui MCP authentication bypass (CVE-2026-33032) exploited actively.
Source finding
USES
nginx-ui -> MCP
nginx-ui MCP integration has critical authentication bypass vulnerability
Source finding

Source trail

Practical DevSecOps Rapid7 — CVE-2026-33032 nginx-ui Missing MCP Authentication Multiple (Trend Micro, OX Security, Infosecurity Magazine)Trend Micro Adversa AI SecurityWeek The Hacker News — Actively Exploited nginx-ui Flaw Enables Full Server Takeover

Graph sources

entity graphfindings textkg edgeskg entities