CVE-2026-42221: nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
0xJacky · nginx-ui
Affected: 0xJacky nginx-ui · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 71% of scored CVEs
DescriptionCVE.org
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- 0xJacky · nginx-ui>= 2.0.0, < 2.3.8
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Nginx UI <= 2.3.7 - Unauthenticated Installer Exposure · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- 0xJacky
- Published
- May 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-42221 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.