Vulnerability · Published May 4, 2026 · Assigned by GitHub_M
CVE-2026-42221nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
High 8.1
In plain English
A high-severity missing authentication in nginx-ui from 0xJacky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/0xJacky/Nginx-UI | 2.3.8 | GHSA-h27v-ph7w-m9fp |
| Go | github.com/0xJacky/Nginx-UI | no fix listed | GO-2026-5412 |
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp x_refsource_CONFIRM
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8 x_refsource_MISC