From 28bc7338b84ea0d32babe30a00b86fab57bf3136 Mon Sep 17 00:00:00 2001
From: Sanjay Mahajan <mahajansanjay@google.com>
Date: Thu, 16 Jul 2026 04:39:56 +0000
Subject: [PATCH] added testbeds for CVE-2026-33032

---
 nginx/CVE-2026-33032/README.md          | 21 +++++++++++++
 nginx/CVE-2026-33032/docker-compose.yml | 42 +++++++++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 nginx/CVE-2026-33032/README.md
 create mode 100644 nginx/CVE-2026-33032/docker-compose.yml

diff --git a/nginx/CVE-2026-33032/README.md b/nginx/CVE-2026-33032/README.md
new file mode 100644
index 00000000..9b03bfb5
--- /dev/null
+++ b/nginx/CVE-2026-33032/README.md
@@ -0,0 +1,21 @@
+# Authentication bypass in Nginx UI MCP endpoint (CVE-2026-33032)
+
+Nginx UI versions 2.3.3 and earlier expose the /mcp_message endpoint without authentication when the IP allowlist is empty. A remote unauthenticated attacker can invoke privileged Model Context Protocol (MCP) operations.
+
+
+## Vulnerable Version
+### Setup
+Start an NginxUI version 2.3.3:
+
+```bash
+docker compose up -d nginx-ui-vuln
+```
+
+## Safe Version 
+### Setup
+Start an NginxUI version 2.3.4:
+
+```bash
+docker compose up -d nginx-ui-safe
+```
+
diff --git a/nginx/CVE-2026-33032/docker-compose.yml b/nginx/CVE-2026-33032/docker-compose.yml
new file mode 100644
index 00000000..f216b1b0
--- /dev/null
+++ b/nginx/CVE-2026-33032/docker-compose.yml
@@ -0,0 +1,42 @@
+services:
+  nginx-ui-vuln:
+    image: uozi/nginx-ui:v2.3.3
+    container_name: nginx-ui
+    restart: always
+    # Expose the ports safely to the outside world
+    ports:
+      - "8080:80"   # Nginx public web traffic proxy
+      - "9000:9000" # Nginx UI web interface dashboard
+    environment:
+      - NGINX_UI_SERVER_RUN_MODE=release
+      - NGINX_UI_IGNORE_DOCKER_SOCKET=true
+      - NGINX_UI_SERVER_SKIP_INSTALLATION=true
+      # Explicitly keep the UI listening internally on 9000
+      - NGINX_UI_SERVER_PORT=9000
+    volumes:
+      - ./data:/etc/nginx-ui
+      - ./nginx:/etc/nginx
+      - ./ssl:/etc/ssl
+      - ./logs:/var/log/nginx
+      - ./www:/var/www/html
+  nginx-ui-safe:
+    image: uozi/nginx-ui:v2.3.4
+    container_name: nginx-ui
+    restart: always
+    # Expose the ports safely to the outside world
+    ports:
+      - "8080:80"   # Nginx public web traffic proxy
+      - "9000:9000" # Nginx UI web interface dashboard
+    environment:
+      - NGINX_UI_SERVER_RUN_MODE=release
+      - NGINX_UI_IGNORE_DOCKER_SOCKET=true
+      - NGINX_UI_SERVER_SKIP_INSTALLATION=true
+      # Explicitly keep the UI listening internally on 9000
+      - NGINX_UI_SERVER_PORT=9000
+    volumes:
+      - ./data:/etc/nginx-ui
+      - ./nginx:/etc/nginx
+      - ./ssl:/etc/ssl
+      - ./logs:/var/log/nginx
+      - ./www:/var/www/html
+