{"id":"EUVD-2026-27137","enisaUuid":"ec7cc46e-2ed9-37e8-8824-2c54ecf2fb5e","description":"Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.","datePublished":"May 4, 2026, 8:11:11 PM","dateUpdated":"May 6, 2026, 1:58:55 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq\n","aliases":"CVE-2026-42222\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"9cf1f37b-f895-3c71-97b1-51efdc5a1370","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003d 2.3.5"}],"enisaIdVendor":[{"id":"31f253b9-fdab-3feb-9c36-2d42263f746d","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"21cb2498-3582-3c7e-8029-a3a93b727abd","vulnerability":{"id":"CVE-2026-42222","description":"Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.","datePublished":"May 4, 2026, 8:11:11 PM","dateUpdated":"May 6, 2026, 1:58:55 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq\n","enisa_id":"EUVD-2026-27137\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Nov 3, 2026, 7:17:08 AM","vulnerabilityProduct":[{"id":"8cd6cb55-1644-3a86-8bbf-31dc4d4f66bc","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003d 2.3.5"}],"vulnerabilityVendor":[{"id":"a51ea081-7479-35e8-87c6-2dad3f8c9a86","vendor":{"name":"0xJacky"}}]}},{"id":"2cfdc0f2-4a03-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-mxqh-q9h6-v8pq","description":"Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover","datePublished":"May 6, 2026, 4:59:43 PM","dateUpdated":"May 6, 2026, 4:59:43 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42222\nhttps://github.com/0xJacky/nginx-ui\n","enisa_id":"EUVD-2026-27137\n","aliases":"CVE-2026-42222\nGHSA-mxqh-q9h6-v8pq\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}