CVE-2026-42222CWE-284CWE-306

nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

High · published May 4, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-306 · Missing Authentication for Critical Function
Published
2026-05-04T20:11Z
EPSS history
Timeline
  • 04 MAY 20:11Z
    nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
    cvelistv5