CVE-2026-42222: nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
Vulnerability summary
CVE-2026-42222 is a critical (CVSS 9.8) Improper Access Control vulnerability in 0xjacky nginx-ui. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 27.4% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 04-05-2026PublishedVulnerability first disclosed.
- 06-05-2026Last modifiedVulnerability information updated.
Description
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · GoEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
Decrease -0.14 pp
From 0.47% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNginx Ui
Maturity: poc
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
0xjacky1 product
- nginx-ui= 2.3.5
Github.com/0xJacky1 product
- Nginx-UI2.3.5 | All versions (No fix recorded)
Nginxui1 product
- nginx_ui2.3.5
3 vendors · 3 products
References
3 links- github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pqX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/0xJacky/nginx-uiPACKAGE