CVE-2026-42222

HIGH

nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

Title source: cna
STIX 2.1

Description

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0034
EPSS Percentile 25.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-284 CWE-306
Status published
Products (3)
0xJacky/nginx-ui Go
0xJacky/nginx-ui = 2.3.5
nginxui/nginx_ui 2.3.5
Published May 04, 2026
Tracked Since May 05, 2026