CVE-2026-42221 - Vulnerability Analysis

Overview

Nginx UI 2.0.0 to < 2.3.8 contains an authentication bypass caused by unauthenticated access to /api/install during first-run setup, letting remote attackers claim the initial admin account, exploit requires attacker to access the service before legitimate operator.

Severity & Score

Impact

Remote attackers can permanently take over the initial administrator account, leading to full control of the instance.

Mitigation

Upgrade to version 2.3.8 or later.

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner