Unauthenticated Bootstrap Takeover in Nginx UI

Publication date: 2026-05-04

Last updated on: 2026-05-06

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-05-06

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-42222

EUVD

EUVD-2026-27137

Affected Vendors & Products

Vendor	Product	Version / Range
nginxui	nginx_ui	2.3.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Nginx UI version 2.3.5, which is a web user interface for the Nginx web server. It involves an unauthenticated bootstrap takeover during the initial installation window, which is exposed by the POST /api/install endpoint. This means that an attacker can potentially take control of the installation process without needing to authenticate.

Impact Analysis

The vulnerability can have a severe impact as it allows an attacker to take over the bootstrap process without authentication. According to the CVSS score of 8.1, it can lead to high confidentiality, integrity, and availability impacts, meaning sensitive data could be exposed or altered, and the system could be disrupted or controlled by an attacker.

Hi! I’m here to help you understand CVE-2026-42222. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70