CVE-2026-42222: Nginx UI Auth Bypass Vulnerability

CVE-2026-42222 Overview

CVE-2026-42222 is an unauthenticated bootstrap takeover vulnerability in Nginx UI version 2.3.5. The flaw resides in the initial installation window exposed by the POST /api/install endpoint. An attacker who reaches this endpoint before a legitimate administrator completes setup can register the first administrative account and seize full control of the Nginx UI instance.

The issue is classified as [CWE-284] Improper Access Control. No public patch is available at the time of publication. The vulnerability affects deployments of nginxui:nginx_ui 2.3.5 reachable over the network.

Critical Impact

Unauthenticated attackers can claim the administrator account on freshly deployed Nginx UI 2.3.5 instances and pivot to full Nginx configuration control.

Affected Products

• Nginx UI 2.3.5 (nginxui:nginx_ui:2.3.5)
• Deployments exposing POST /api/install to untrusted networks
• Container, bare-metal, and reverse-proxy installations during the bootstrap window

Discovery Timeline

• 2026-05-04 - CVE-2026-42222 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-42222

Vulnerability Analysis

Nginx UI is a web management interface for the Nginx web server. On first launch, the application exposes an installation workflow at POST /api/install that creates the initial administrator credentials. The endpoint does not require authentication because no account exists yet.

The vulnerability stems from the way the bootstrap state is managed. An attacker who reaches /api/install before the administrator does can submit arbitrary credentials and become the first administrator. After takeover, the attacker controls Nginx configuration, TLS certificates, and any host-level commands the UI is permitted to execute.

The scope extends beyond credential theft. Nginx UI manages reverse proxy rules and can issue certificates, so attacker control over the bootstrap account translates to control over downstream web traffic and integrated services.

Root Cause

The root cause is improper access control on a privileged provisioning endpoint. The installation route is intended to be reachable only during a narrow first-run window, but the application does not enforce a sufficient binding between that window and a trusted local context. Any network client that wins the race against the administrator can complete setup.

Attack Vector

The attack vector is network-based and requires no authentication, no privileges, and no user interaction. An attacker performs HTTP reconnaissance for newly exposed Nginx UI 2.3.5 endpoints and issues a single POST /api/install request containing attacker-chosen credentials. Successful provisioning returns an authenticated session that grants full administrative access to the Nginx UI.

For technical details, refer to the GitHub Security Advisory GHSA-mxqh-q9h6-v8pq.

Detection Methods for CVE-2026-42222

Indicators of Compromise

• Unexpected POST /api/install requests in Nginx UI access logs from external or non-administrative source addresses
• Administrator accounts in the Nginx UI database that the operations team did not create
• Unauthorized changes to Nginx server blocks, upstream definitions, or TLS certificate configuration immediately after deployment
• New SSH keys, scheduled tasks, or outbound connections originating from the Nginx UI host shortly after first boot

Detection Strategies

• Alert on any HTTP request to /api/install once initial provisioning is complete; legitimate traffic to this path should be zero
• Compare administrator account creation timestamps against deployment runbooks to identify out-of-band account creation
• Monitor for configuration file diffs in Nginx managed by nginx-ui that occur outside change-control windows

Monitoring Recommendations

• Forward Nginx UI access and audit logs to a centralized SIEM with retention covering the deployment window
• Track first-login source IP addresses for new Nginx UI installations and flag mismatches with administrator workstations
• Baseline outbound connections from hosts running Nginx UI and alert on deviations

How to Mitigate CVE-2026-42222

Immediate Actions Required

• Restrict network access to Nginx UI to trusted management networks or localhost until provisioning is complete
• Complete the installation workflow immediately after starting Nginx UI 2.3.5, before any external exposure
• Audit existing 2.3.5 deployments for unauthorized administrator accounts and rotate all credentials and API tokens
• Review Nginx configuration files, TLS material, and host artifacts for unauthorized modifications

Patch Information

No public patches are available at the time of publication. Track the GitHub Security Advisory GHSA-mxqh-q9h6-v8pq for vendor updates and apply fixed releases as soon as they are published.

Workarounds

• Bind Nginx UI to 127.0.0.1 and tunnel administrative access through SSH or a VPN until a patched version is released
• Place Nginx UI behind an authenticating reverse proxy or network access control list that blocks POST /api/install from untrusted sources
• Provision new instances on isolated networks, complete POST /api/install from a trusted host, and only then expose the management interface

# Configuration example: restrict Nginx UI to localhost and block /api/install at the proxy
# 1. Bind nginx-ui to loopback in its config
# app.ini
# [server]
# HttpHost = 127.0.0.1
# HttpPort = 9000

# 2. Front with an authenticating reverse proxy and deny the install route post-setup
location = /api/install {
    deny all;
    return 403;
}

location / {
    auth_basic "nginx-ui management";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:9000;
}