Paper/Archive/CVE-2026-42222

CVE-2026-42222

0xJacky nginx-ui — nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

EPSS 0.3%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 27.4.274 × 205.5 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.

Affected

ProductAffectedFixed inSource

nginx-ui= 2.3.5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub_M (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq