A critical authentication bypass vulnerability in nginx-ui dubbed “MCPwn,” is being actively exploited to fully compromise exposed Nginx servers. The flaw, tracked as CVE-2026-33032, affects the platform’s Model Context Protocol (MCP) integration, where the /mcp_message endpoint is left insufficiently protected and, by default, allows requests from any IP address without requiring authentication. This enables remote attackers to invoke privileged MCP functions such as restarting Nginx, modifying or deleting configuration files, injecting malicious server blocks, forcing configuration reloads, intercepting traffic, and harvesting administrator credentials. Researchers found that exploitation can occur in seconds using just two (1) requests. The first establishes a session and obtains a session ID, and the second issues unauthorized MCP commands through /mcp_message. Attackers can further enhance exploitation by chaining the flaw with CVE-2026-27944, a separate nginx-ui vulnerability that exposes backup encryption keys and sensitive data such as user credentials, SSL private keys, Nginx configurations, and the “node_secret” value used to authenticate MCP sessions. Security researchers warn that the issue reflects a broader risk with MCP integrations, where newly added AI- or automation-related capabilities inherit application functionality without inheriting the same security protections. The flaw was patched in nginx-ui version 2.3.4 in March 2026, but public proof-of-concept exploit code and technical details quickly became available, accelerating attacks in the wild. Current Shodan data indicates there are roughly 2,600 to 2,700 internet-exposed nginx-ui instances, primarily located in China, the United States, Indonesia, Germany, and Hong Kong, leaving a large attack surface for threat actors. CTIX analysts strongly advise administrators to upgrade immediately to the latest secure release, currently version 2.3.6, disable MCP functionality where possible, restrict network exposure, and enforce authentication on MCP endpoints, as well as adopt deny-by-default IP allowlisting.