216.73.217.86

CVE-2026-42221

· Published 04/05/2026 21:16 · Modified 04/05/2026 21:16

Labels: CVE-2026-42221 2026-05-04CVE-2026-42221CWE-306[email protected]

Essential information

Published
04/05/2026 21:16
Modified
04/05/2026 21:16
Author
Creator
CVSS
8.1 HIGH (v3.1)
CISA KEV
No
CWE
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS metrics

Description

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
nginx / nginx ui cpe:2.3:a:nginx:nginx_ui:2.0.0-2.3.7:*:*:*:*:*:*:*

References