CVE-2026-42222 Details
Description
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
A vulnerability allowing unauthenticated bootstrap takeover has been identified in Nginx UI version 2.3.5. This issue arises during the initial installation phase, when the application is still uninitialized and accessible without authentication. The vulnerability is exploited by sending a POST request to /api/install with attacker-controlled bootstrap data, which includes the application's JWT secret, node secret, certificate email, and initial administrator credentials. This allows an attacker to claim control of the installation before the legitimate operator can intervene. The vulnerability is particularly concerning in environments where Nginx UI is deployed fresh and exposed over the network, as it enables complete administrative control without authentication.
No public patches are currently available for this vulnerability. However, it is recommended to remove remote unauthenticated installation as a security boundary, require a local-only or out-of-band bootstrap secret for the installation process, and bind initial setup to trusted local access paths.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq | CISA-ADP | ExploitVendor Advisory |
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nginxui nginx ui | 2.3.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |