CVE-2026-42221: Nginx UI Authentication Bypass Vulnerability

CVE-2026-42221 Overview

CVE-2026-42221 is a critical authentication flaw in Nginx UI, a web user interface for the Nginx web server. Versions from 2.0.0 to before 2.3.8 expose the /api/install endpoint without authentication during the first-run setup window. An unauthenticated network attacker who reaches a fresh nginx-ui instance before the legitimate operator can claim the initial administrator account by setting the admin email, username, and password. The flaw is tracked under [CWE-306: Missing Authentication for Critical Function]. The maintainer patched the issue in version 2.3.8.

Critical Impact
A remote, unauthenticated attacker can permanently take over the initial administrator account of a fresh Nginx UI instance, gaining full control over the managed Nginx server.

Affected Products

Nginx UI versions 2.0.0 through 2.3.7
Vendor: nginxui
Fixed version: Nginx UI 2.3.8

Discovery Timeline

2026-05-04 - CVE-2026-42221 published to NVD
2026-05-06 - Last updated in NVD database
Patch released in Nginx UI v2.3.8. See the GitHub Security Advisory GHSA-h27v-ph7w-m9fp.

Technical Details for CVE-2026-42221

Vulnerability Analysis

The vulnerability stems from a missing authentication check on the /api/install endpoint used during the initial setup of Nginx UI. The endpoint is publicly reachable on a freshly deployed instance and accepts the administrator credentials submitted by the first caller. Whoever submits valid installation parameters first becomes the persistent administrator.

The project implements a request-encryption flow that protects payload confidentiality in transit. However, encryption is not authentication. The flow does not verify that the caller is the legitimate operator or that the request originates from a trusted source. Confidentiality controls cannot prevent an unauthorized party from completing setup.

Once the attacker controls the initial admin account, they can manage Nginx configurations, push arbitrary site definitions, modify TLS settings, and pivot further into the host environment. Because the takeover is permanent, the legitimate operator cannot reclaim the instance without redeployment.

Root Cause

The root cause is [CWE-306: Missing Authentication for Critical Function]. The installation handler treats the first-run window as implicitly trusted, but exposes the endpoint on the network without binding it to a local-only interface, an out-of-band setup token, or operator-supplied proof of possession.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker scans for newly provisioned Nginx UI instances and submits a crafted POST request to /api/install containing attacker-controlled email, username, and password values. If the request lands before the legitimate operator completes setup, the attacker becomes the persistent administrator.

No public proof-of-concept code is referenced in the advisory. Refer to the GitHub Security Advisory GHSA-h27v-ph7w-m9fp for vendor-supplied technical details.

Detection Methods for CVE-2026-42221

Indicators of Compromise

Successful HTTP requests to /api/install from unexpected source IP addresses on a newly deployed Nginx UI instance.
Initial administrator account created with an email, username, or password that does not match operator records.
Login activity to Nginx UI from geographies or networks outside the operator baseline immediately after deployment.
Unexpected modifications to Nginx site configurations or TLS certificates following first boot.

Detection Strategies

Inspect reverse proxy and Nginx UI access logs for POST /api/install requests and correlate the source IP against the deployment operator.
Compare the timestamp of the first /api/install call to the planned maintenance window for the deployment.
Audit the Nginx UI user database after provisioning to validate the initial admin identity.

Monitoring Recommendations

Alert on any external traffic to Nginx UI management endpoints, including /api/install, prior to operator handoff.
Track creation of administrator accounts in Nginx UI and forward events to a central logging or SIEM platform.
Monitor configuration changes within Nginx UI and flag changes that occur before documented operator login.

How to Mitigate CVE-2026-42221

Immediate Actions Required

Upgrade all Nginx UI deployments to version 2.3.8 or later as published in the GitHub Release v2.3.8.
Audit existing instances deployed on versions 2.0.0 through 2.3.7 to confirm the legitimate operator owns the initial admin account.
Rebuild any instance where the first-run setup window may have been claimed by an unknown party.

Patch Information

The maintainer fixed the issue in Nginx UI v2.3.8. Review the GitHub Security Advisory GHSA-h27v-ph7w-m9fp and the GitHub Release v2.3.8 for upgrade instructions.

Workarounds

Bind Nginx UI to the loopback interface during initial setup and access it through an SSH tunnel until the administrator account is created.
Place Nginx UI behind a network access control list that allows only operator source addresses during deployment.
Complete the first-run setup immediately after provisioning and avoid leaving fresh instances exposed to untrusted networks.

bash

# Restrict Nginx UI to localhost during first-run setup, then SSH tunnel from the operator workstation
# /etc/nginx-ui/app.ini
[server]
Host = 127.0.0.1
Port = 9000

# From the operator workstation
ssh -L 9000:127.0.0.1:9000 operator@nginx-ui-host
# Then browse to http://127.0.0.1:9000 to claim the admin account