title: nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)
id: ATR-2026-00536
rule_version: 1
status: experimental
description: |
  Detects CVE-2026-33032 (CVSS 9.8): nginx-ui exposes an MCP server endpoint that executes system commands — including nginx reload/restart, config writes, and raw shell commands — without requiring authentication. An unauthenticated network attacker can invoke MCP tool calls directly against the nginx-ui service and gain OS-level command execution on the host. Detection covers (a) tool call patterns invoking nginx management functions without an Authorization header present in the same exchange, (b) MCP config blocks pointing at nginx-ui endpoints with no auth fields, (c) payloads referencing the nginx_command_execute / nginx_reload MCP tool names, and (d) content describing the unauthenticated MCP surface of nginx-ui. CWE-306 (Missing Authentication for Critical Function), CWE-78 (OS Command Injection).
author: ATR Community
date: 2026/05/20
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM06:2025
    - LLM05:2025
  owasp_agentic:
    - ASI05:2026
    - ASI06:2026
  mitre_atlas:
    - AML.T0049 - Exploit Public-Facing Application
    - AML.T0040 - AI Model Inference API Access
  mitre_attack:
    - T1190 - Exploit Public-Facing Application
    - T1059.004 - Unix Shell
    - T1078 - Valid Accounts
  cve:
    - CVE-2026-33032
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2026-33032 nginx-ui MCP endpoint executes OS commands without an authentication challenge; Article 15 cybersecurity requirements mandate that AI tool servers enforce authentication on every command-execution function before network exposure.
      strength: primary
    - article: '9'
      context: Article 9 risk management must enumerate unauthenticated MCP command-execution endpoints as a critical access-control failure mode for any agent-integrated infrastructure management tool.
      strength: primary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: Runtime detection of unauthenticated MCP tool invocations against nginx-ui is the primary risk treatment for CVE-2026-33032; organizations must block tool calls that lack a verified identity context.
      strength: primary
    - function: Map
      subcategory: MP.5.1
      context: Unauthenticated MCP command-execution surfaces must be catalogued as high-severity threats in the organizational AI risk register for any deployment integrating nginx-ui with an agent framework.
      strength: secondary
    - subcategory: GV.6.1
      function: Govern
      context: Third-party MCP-enabled server tools (including nginx-ui) must be assessed under GV.6.1 supplier risk management for missing-authentication-on-critical-function controls before agent pipelines depend on them.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must detect and block MCP server registrations or tool invocations targeting nginx-ui command-execution endpoints without a verified authentication mechanism.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: mcp-missing-authentication
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - nginx-ui
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Internal-only nginx-ui deployments accessible solely over authenticated VPN where the MCP endpoint is intentionally gated by perimeter auth.
    - Security scanning tooling that probes the nginx-ui MCP endpoint to detect CVE-2026-33032 exposure.
    - Educational documentation describing the nginx-ui MCP architecture.
  conditions:
    - field: tool_response
      operator: regex
      value: (?i)"(?:name|tool)"\s*:\s*"(?:nginx_command_execute|nginx_reload|nginx_restart|nginx_test|nginx_config_write|nginx_config_reload|nginx[_\-](?:command|exec|run|reload|restart|stop|start|test|config))[^"]{0,60}"(?:(?!(?:authorization|bearer|api[_\-]?key|x-api-key|token|x-auth))[\s\S]){0,500}
      description: MCP tool call targeting nginx management function without any Authorization/token field in surrounding context — CVE-2026-33032 direct exploitation pattern
    - field: tool_response
      operator: regex
      value: (?i)"url"\s*:\s*"https?://[^"]{0,80}(?:nginx[_\-]?ui|nginx\.ui|nginxui|/nginx/ui)[^"]{0,60}(?:/mcp|/tools?|/api/v1/mcp)[^"]*"(?:(?!"(?:auth|headers|token|apiKey|authorization|bearer)")[\s\S]){0,400}}
      description: MCP server config pointing at nginx-ui endpoint URL without auth/headers field — unauthenticated surface exposure
    - field: tool_response
      operator: regex
      value: (?i)(?:"(?:command|cmd|args)"\s*:\s*"[^"]{0,200}nginx\s+-s\s+(?:reload|restart|stop|quit|reopen)|"args"\s*:\s*(?:\{[^}]{0,200}|\[[^\]]{0,200})nginx\s+-c\s+/[^'"\s]{0,80}|nginx\s+-t\s*[;|&]|nginx[_\-]command_execute[^'"]{0,40}(?:;|\||&&|`|\$\()[^'"]{0,200})
      description: nginx command injection pattern inside MCP tool arguments — direct OS command execution via nginx-ui MCP
    - field: content
      operator: regex
      value: (?i)nginx[_\-]?ui[^\n]{0,200}(?:mcp|tool\s+call|tool\s+server|endpoint)[^\n]{0,200}(?:no\s+auth|missing\s+auth|unauth(?:enticated|orised)?|without\s+(?:auth|credentials?|token)|bypass\s+auth|cve[_\-]?2026[_\-]?33032|execut(?:e|ing)\s+(?:commands?|shell)|command\s+execut)
      description: Content describing or weaponising the nginx-ui MCP unauthenticated command execution surface — CVE-2026-33032 framing
    - field: tool_response
      operator: regex
      value: (?i)"tools"\s*:\s*\[(?:[^\]]{0,400}(?:nginx_(?:command_execute|reload|restart|config_write|test)|manage_nginx|nginx[_\-]service)[^\]]{0,400})\](?:(?!(?:www[_\-]?authenticate|authorization|x-api-key|bearer\s+token))[\s\S]){0,600}
      description: nginx-ui MCP handshake exposes nginx management tools without an authentication challenge in the same exchange
response:
  actions:
    - block_tool
    - alert
    - escalate
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-00536] CRITICAL: nginx-ui MCP unauthenticated command execution detected (CVE-2026-33032, CVSS 9.8). An MCP tool call targets nginx management functions (nginx_command_execute / nginx_reload / nginx_restart / config write) on an nginx-ui endpoint without an authentication credential present in the exchange, or content describes this unauthenticated attack surface. Block tool invocation immediately; require authentication on all nginx-ui MCP endpoints; treat any nginx-ui MCP server lacking auth-header configuration as out-of-scope for agent toolchains until patched.
confidence: 85