CVE-2026-42222 — nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window expo…
Published: 2026-05-04 · CVSS: 8.1 · CVSS 3.1
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7