CVE-2026-42222

nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

View on CVE.org
Published May 4, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.

Analysis

AI-generated

Technical impact

An unauthenticated bootstrap takeover vulnerability exists in nginx-ui version 2.3.5 where an attacker can send a POST request to /api/install during the initial installation window and claim the instance. The vulnerability allows the attacker to control the deployment process and configure the service under their own settings, potentially compromising the confidentiality, integrity, and availability of the system. The weakness is rooted in missing access control (CWE‑284) and lack of authentication (CWE‑306).

Affected Systems

The affected product is nginx-ui from 0xJacky, specifically version 2.3.5. No other versions were listed as affected in the advisory.

Risk and Exploitability

With a CVSS score of 8.1, the vulnerability is considered high severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST to /api/install performed during the instance’s first‑boot installation period, inferred from the description of the bootstrap takeover.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict network access to the /api/install endpoint during the initial installation period using firewall rules or IP filtering to limit exposure to trusted IP ranges.
  • Deploy a newer nginx‑ui release or apply the vendor patch immediately once it becomes available.
  • Apply additional authentication (e.g., HTTP basic auth or a reverse proxy) to protect the installation endpoint as a temporary safeguard until the vulnerability is fixed.

Generated by OpenCVE AI on May 4, 2026 at 21:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-mxqh-q9h6-v8pq Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
History
Type Values Removed Values Added
First Time appeared Nginxui
Nginxui nginx Ui
CPEs cpe:2.3:a:nginxui:nginx_ui:2.3.5:*:*:*:*:*:*:*
Vendors & Products Nginxui
Nginxui nginx Ui
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared 0xjacky
0xjacky nginx-ui
Vendors & Products 0xjacky
0xjacky nginx-ui
Type Values Removed Values Added
Description Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
Title nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
Weaknesses CWE-284
CWE-306
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
May 6, 2026, 1:58 PM
Reserved
Apr 25, 2026, 5:37 AM

View source JSON

Updated
May 6, 2026, 1:58 PM

JSON

Status
Analyzed
Published
May 4, 2026, 9:16 PM
Modified
Oct 26, 2026, 7:10 PM

View source JSON

No data.

Updated
May 4, 2026, 9:30 PM

JSON