April 2026 dropped some serious vulnerabilities. Not the usual noise. These are the kind that create new bug classes, new hunting patterns, and new payout opportunities. I dug into each one and pulled out what matters for bounty hunters.
MCPwn: When AI Integration Kills Your Auth (CVE-2026-33032)
This one is fascinating because it represents an entirely new bug class. nginx-ui, a popular web management tool with 2,600+ exposed instances, added MCP (Model Context Protocol) integration so AI agents could manage Nginx configs. The problem? They forgot to put auth on the tool-invocation endpoint.
The vulnerable Go code tells the whole story. The /mcp endpoint has both IPWhiteList() and AuthRequired() middleware. The /mcp_message endpoint only has IPWhiteList(). And the default IP whitelist is empty, which the middleware treats as allow-all. Two HTTP requests, zero credentials, full server takeover.
The exploit chain: Step 1 - GET /mcp to establish an SSE session and receive a session ID. Step 2 - POST /mcp_message with that session ID to invoke any of 12 MCP tools including nginx_config_add with auto-reload. You can inject arbitrary Nginx configs, intercept traffic, harvest credentials, and forge admin tokens.
Chain it with CVE-2026-27944, which exposes /api/backup without authentication. That backup contains the node_secret, encryption keys, user credentials, and SSL private keys. With the node_secret you authenticate the first request, making the full chain completely unauthenticated. CVSS 9.8. Actively exploited since March 2026.
Bug Bounty Takeaway
This pattern will repeat. Every tool adding MCP integration is a potential target. The bug: session establishment endpoint gets proper auth, but the tool-invocation endpoint does not. Hunt for /mcp, /mcp_message, /tool/call, /agent/execute on any management UI with AI features. Also check: does an empty allowlist mean allow-all or deny-all? Fail-open access controls are everywhere.
Thymeleaf SSTI: Restriction Bypass to RCE (CVE-2026-40477)
Thymeleaf is one of the most popular Java template engines, used heavily in Spring Boot apps. CVE-2026-40477 (CVSS 9.0) bypasses its built-in object access restrictions. If an application passes unvalidated user input to the template engine, an unauthenticated attacker achieves Server-Side Template Injection leading to RCE. Affected: Thymeleaf 3.1.3.RELEASE and prior. Fixed in 3.1.4.RELEASE.
Test payloads: ${77} returns 49 if vulnerable. {7*7} works in Spring-specific contexts. For RCE: __${T(java.lang.Runtime).getRuntime().exec('id')}__::.x. Look for SSTI in error pages, PDF generators, email templates, search results, and anywhere user input gets reflected through server rendering.
Bug Bounty Takeaway
Spring Boot + Thymeleaf is extremely common in enterprise targets. Even apps that thought they were protected by Thymeleaf's built-in restrictions are vulnerable. If you find any reflection in a Java/Spring app, test SSTI payloads immediately. SSTI to RCE is consistently a P1/Critical finding.
April Patch Tuesday: 164 CVEs, 2 Zero-Days
Microsoft patched 164 CVEs. The ones that matter: CVE-2026-33824 (Windows IKE, CVSS 9.8) is unauthenticated RCE via double-free with no user interaction. CVE-2026-32201 (SharePoint) is actively exploited in the wild. CVE-2026-33825 (Defender EoP) has a public PoC. Three Office/Word RCEs (CVE-2026-32190, 33114, 33115) at CVSS 8.4 each trigger via Preview Pane without opening the file.
The Preview Pane vector matters for bounty hunters. If a target has document upload and preview, a malicious docx/xlsx could trigger code execution on the server just by being previewed. That is a chain worth testing.
Other Notable CVEs
CVE-2026-20127 (Cisco SD-WAN, CVSS 10.0): Auth bypass with widespread exploitation. CVE-2026-2441 (Chrome CSS use-after-free): Active in the wild, chains into authenticated SaaS dashboards. CVE-2026-26030 (Microsoft Semantic Kernel): Code generation control flaw in AI orchestration, the Semantic Kernel equivalent of MCPwn. CVE-2026-5194 (wolfSSL): Critical crypto library vulnerability.
The Bug Bounty Landscape in April 2026
HackerOne programs paid $81M over the past year (13% increase). IDOR remains the most rewarded class at 30% of paid submissions. But AI agents are flooding programs with noise. Half of AI-generated submissions are duplicates. Some companies are going private due to report volume. The winning strategy: go deep on one target, focus on complex chains, avoid saturated vuln classes where AI scanners compete.
Five New Hunting Patterns
(1) MCP Integration Auth Gap: test if the tool-call endpoint has the same auth as the session endpoint. (2) IP Whitelist Fail-Open: check if empty allowlists mean allow-all. (3) SSTI Object Scope Bypass: test ${7*7} on every Java/Spring target. (4) Backup Endpoint Credential Leakage: /api/backup, /api/export without auth. (5) Preview Pane RCE: document upload with server-side preview can trigger execution without files being opened.
Sources
The Hacker News, Picus Security (MCPwn deep-dive), CrowdStrike (April Patch Tuesday analysis), SecurityWeek, Rapid7, Penligent AI, PortSwigger Research (Top 10 Web Hacking Techniques 2025).
No comments yet