CVE-2026-42222
HighSummary
In version 2.3.5 of the Nginx user interface (nginx-ui), there is an unauthenticated bootstrap takeover vulnerability during the initial installation exposed by POST /api/install.
Risk Assessment
Organizations may be exposed to unauthorized access to the Nginx system, potentially leading to serious security breaches.
Recommendation
It is recommended to avoid using version 2.3.5 of nginx-ui until patches are released and to monitor for available updates.
Other vulnerabilities in nginx-ui
See all- CVE-2026-44015High
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL.
- CVE-2026-42221High
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window.
- CVE-2026-42238Critical
Nginx UI, a web user interface for the Nginx web server, prior to version 2.3.8, exposed a backup restore endpoint (POST /api/restore) that was completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker could upload a crafted backup archive that overwrote the application's configuration file and SQLite database.
Original NVD description (English source)
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.