CVE-2026-42222
Nginx UI is a web user interface for the Nginx web server.
Published May 4, 2026 · updated Jun 17, 2026 · nginxui nginx ui
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 4, 2026 · NIST NVD
Detected
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
Jun 17, 2026 · NIST NVD
Updated
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
Affected
- cpe nginxui/nginx ui2.3.5
Sources
- CVE.orgVulnerability recordCVE-2026-42222
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-42222
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
nvd.nist.gov