CVE-2026-42222

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq	Exploit Vendor Advisory
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nginxui:nginx_ui:2.3.5:*:*:*:*:*:*:*

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Nginx UI es una interfaz de usuario web para el servidor web Nginx. En la versión 2.3.5, existe una toma de control de arranque no autenticada en nginx-ui durante la ventana de instalación inicial expuesta por POST /api/install. En el momento de la publicación no hay parches públicos disponibles.

Information

Published : 2026-05-04 21:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-42222

Mitre link : CVE-2026-42222

CVE.ORG link : CVE-2026-42222

JSON object : View

Products Affected

nginxui

nginx_ui

CWE

CWE-284

Improper Access Control

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-42222", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42222", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T13:58:14.531766Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "0xJacky", "product": "nginx-ui", "versions": [{"status": "affected", "version": "= 2.3.5"}]}]}], "published": "2026-05-04T21:16:32.173", "references": [{"url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available."}, {"lang": "es", "value": "Nginx UI es una interfaz de usuario web para el servidor web Nginx. En la versi\u00f3n 2.3.5, existe una toma de control de arranque no autenticada en nginx-ui durante la ventana de instalaci\u00f3n inicial expuesta por POST /api/install. En el momento de la publicaci\u00f3n no hay parches p\u00fablicos disponibles."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "220AB408-E585-4E99-882C-0892D73A3516"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}