CVE-2026-42221 nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
Remote attackers can claim the initial admin account on fresh Nginx UI instances via an unauthenticated install endpoint, leading to full system takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42221?
CVE-2026-42221 is a high-severity authentication bypass vulnerability in 0xJacky nginx-ui, published on 4 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.
Weakness: CWE-306
Which versions are affected by CVE-2026-42221?
3 open source packages ship an affected version, including github.com/0xJacky/Nginx-UI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/0xJacky/Nginx-UI Go | All versions | None |
github.com/0xJacky/Nginx-UI Go | From 2.0.0 | 2.3.8 |
github.com/0xJacky/Nginx-UI Go | From 2.0.0 | 2.3.8 |
Products include Nginxui Nginx Ui.
How do I fix CVE-2026-42221?
Upgrade github.com/0xJacky/Nginx-UI to 2.3.8 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-42221 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42221 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in 0xJacky nginx-ui
- CVE-2026-33032 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
- CVE-2026-27944 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
- CVE-2024-23827 Nginx-UI arbitrary file write through the Import Certificate feature
- CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
- CVE-2026-33026 nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Sources
Also known as GHSA-h27v-ph7w-m9fp, GO-2026-5412.