{"id":"EUVD-2026-27135","enisaUuid":"b50c2be1-c2d9-3e07-8453-2eec39d57549","description":"Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.","datePublished":"May 4, 2026, 8:09:37 PM","dateUpdated":"May 5, 2026, 2:14:11 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8\n","aliases":"CVE-2026-42221\n","assigner":"GitHub_M","epss":1.34,"enisaIdProduct":[{"id":"1442358c-6d3d-385f-a626-82574a20d0df","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.3.8"}],"enisaIdVendor":[{"id":"bcbded23-f53c-3726-aa58-cc5832527bbe","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"2cfe6c9f-4a03-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-h27v-ph7w-m9fp","description":"Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim","datePublished":"May 6, 2026, 4:59:00 PM","dateUpdated":"May 6, 2026, 4:59:00 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42221\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8\n","enisa_id":"EUVD-2026-27135\n","aliases":"GHSA-h27v-ph7w-m9fp\nCVE-2026-42221\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d13479f0-b399-30ff-bf0d-3957ec200983","vulnerability":{"id":"CVE-2026-42221","description":"Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.","datePublished":"May 4, 2026, 8:09:37 PM","dateUpdated":"May 5, 2026, 2:14:11 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8\n","enisa_id":"EUVD-2026-27135\n","assigner":"GitHub_M","epss":1.34,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"528a5447-4bdb-3119-86c6-2171e9aba31b","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.3.8"}],"vulnerabilityVendor":[{"id":"28f3a8f8-5a64-3f20-a974-fefec39f69f2","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}