Executive brief
Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui
Affected products
- Go github.com/0xJacky/Nginx-UI
Junglewise Threat Intelligence
CVE-2026-42222: GO-2026-5521 - Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui
CVE-2026-42222 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/0xJacky/Nginx-UI (Go). Vendors: Go.
Related threats
- GO-2026-5565 - Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui
- GO-2026-5412 - Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI
- GO-2026-5210 - Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints in github.com/0xJacky/Nginx-UI
- GO-2026-5227 - Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and rest
- GO-2026-5129 - Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui