{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-33032/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-33032/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-33032/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-33032/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-33032/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-33032/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-33032"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-33032"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-33032.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-33032\n\ninfo:\n  name: Nginx UI - Broken Access Control\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover.\n  impact: |\n    An unauthenticated attacker with a valid MCP session ID can inject arbitrary nginx configurations,create reverse proxies for credential theft, and achieve remote code execution via nginx config primitives.\n  remediation: Upgrade to nginx-ui v2.3.4 or later which adds AuthRequired() to /mcp_message.\n  reference:\n    - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf\n    - https://github.com/0xJacky/nginx-ui/commit/413dc631\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33032\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-33032\n    epss-score: 0.35273\n    epss-percentile: 0.98451\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    product: nginx-ui\n    shodan-query: http.title:\"Nginx UI\"\n    fofa-query: title=\"Nginx UI\"\n  tags: cve,cve2026,nginx-ui,mcp,unauth,misconfig,vkev\n\nvariables:\n  string: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /mcp_message HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"jsonrpc\":\"2.0\",\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"{{string}}\",\"version\":\"1.0\"}},\"id\":1}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{\"jsonrpc\":'\n          - '\"message\":'\n          - '\"id\":'\n        condition: and\n\n      - type: status\n        status:\n          - 400\n# digest: 4b0a00483046022100e7ac9bde00e0240d75fea25e631cddf7e6cd24e659b0676af9e8588f19f0a2cd0221009281028baf591e30e8e2aa69ab9d4722147d0e770614c0b17db14442aef0d798:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-33032"}