CVE-2026-42238 Overview
CVE-2026-42238 is a critical command injection vulnerability in Nginx UI, a web user interface for the Nginx web server. Versions prior to 2.3.8 expose the POST /api/restore backup restore endpoint without authentication during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites app.ini and the SQLite database. The attacker controls the restored configuration and injects an arbitrary OS command into the TestConfigCmd setting. After the application restarts to apply the configuration, a single follow-up request executes the command as the user running nginx-ui — typically root in Docker deployments.
Critical Impact
Unauthenticated remote code execution as root on default Docker deployments of Nginx UI versions earlier than 2.3.8.
Affected Products
- Nginx UI versions prior to 2.3.8
- Docker deployments running Nginx UI as root
- Fresh installations within the 10-minute startup window
Discovery Timeline
- 2026-05-04 - CVE-2026-42238 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-42238
Vulnerability Analysis
The vulnerability is classified as Code Injection [CWE-94] and stems from a missing authentication check on a sensitive administrative endpoint. The POST /api/restore route accepts backup archives that overwrite the running application's configuration file app.ini and its SQLite database. Because no authentication is enforced during the first 10 minutes after startup, any network-reachable attacker can supply attacker-controlled state to a fresh installation.
The restored app.ini is parsed and applied automatically. The TestConfigCmd configuration setting accepts an arbitrary OS command intended to validate Nginx configuration. After the automatic restart, a follow-up HTTP request that invokes the configuration test path causes the application to execute the attacker-supplied command. In Docker deployments, the nginx-ui process runs as root, granting full container compromise and a foothold for lateral movement.
Root Cause
The root cause is a design flaw in the startup grace period: the restore endpoint is intentionally unauthenticated to support initial provisioning, but no source restriction, token, or first-run consent gate prevents network attackers from abusing it. The configuration loader also trusts attacker-controlled values for TestConfigCmd, treating restored configuration as trusted input.
Attack Vector
Exploitation requires only network access to the Nginx UI service during the 10-minute startup window on a fresh installation. The attacker sends a crafted backup archive to /api/restore, waits for the automatic restart, and issues a follow-up request that triggers the injected TestConfigCmd payload. No user credentials or interaction with an existing administrator are required.
For technical details, see the GitHub Security Advisory GHSA-4pvg-prr3-9cxr.
Detection Methods for CVE-2026-42238
Indicators of Compromise
- Unexpected POST /api/restore requests in Nginx UI access logs, particularly within 10 minutes of process start
- Modifications to app.ini or the nginx-ui SQLite database that do not correspond to administrator activity
- Unexpected child processes spawned by the nginx-ui binary, especially shells or network utilities
- Outbound connections from the nginx-ui container to unfamiliar external hosts following a restart event
Detection Strategies
- Alert on any HTTP request to /api/restore that does not originate from approved administrative IP ranges
- Monitor for repeated nginx-ui process restarts followed by anomalous command execution
- Compare deployed app.ini content against a known-good baseline and flag changes to TestConfigCmd
- Inspect container runtime telemetry for nginx-ui processes executing /bin/sh, curl, wget, or other post-exploitation tooling
Monitoring Recommendations
- Forward nginx-ui application and access logs to a centralized SIEM for correlation with process telemetry
- Track file integrity on app.ini and the SQLite database used by nginx-ui
- Capture and retain process lineage from container hosts to identify command execution chains rooted at nginx-ui
How to Mitigate CVE-2026-42238
Immediate Actions Required
- Upgrade Nginx UI to version 2.3.8 or later on every host and container image
- Restrict network exposure of the Nginx UI management interface to trusted administrative networks or VPNs
- Audit running deployments for evidence of unauthorized /api/restore activity and unexpected app.ini changes
- Avoid running the nginx-ui container as root; configure a non-privileged user where supported
Patch Information
The vulnerability is patched in Nginx UI version 2.3.8. Release notes and upgrade guidance are available at the GitHub Release v2.3.8 page. Administrators should pull the updated container image and redeploy, ensuring no fresh installation of an unpatched version is exposed to untrusted networks.
Workarounds
- Block external access to the /api/restore endpoint at a reverse proxy or web application firewall until the patch is applied
- Place Nginx UI behind network-level authentication such as mutual TLS or an authenticating reverse proxy
- Avoid performing fresh installations of vulnerable versions on internet-reachable hosts, since the 10-minute window starts at every process launch
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
