EUVD-2026-27137
GHSA-mxqh-q9h6-v8pq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
1DescriptionGitHub Advisory
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
AnalysisAI
Unauthenticated bootstrap takeover in nginx-ui 2.3.5 allows remote attackers to hijack the initial installation process via crafted POST requests to /api/install endpoint. An attacker who successfully exploits the installation window gains full administrative control over the nginx-ui instance before legitimate administrators complete setup. No vendor-released patch identified at time of analysis, creating extended exposure risk for newly deployed instances.
Technical ContextAI
nginx-ui is a web-based management interface for the Nginx web server, providing administrative capabilities through a REST API. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), specifically affecting the bootstrap installation endpoint POST /api/install exposed during first-run configuration. The affected component (cpe:2.3:a:0xjacky:nginx-ui:*:*:*:*:*:*:*:*) fails to implement authentication checks during the critical initialization phase when administrative credentials are established. This represents a classic race condition window where the installation endpoint remains publicly accessible on the network before legitimate administrators complete the setup wizard. The underlying flaw allows arbitrary actors to invoke privileged installation functions that should be restricted to authorized first-time setup scenarios.
RemediationAI
No vendor-released patch identified at time of analysis per CVE description stating 'no public patches are available.' Organizations deploying nginx-ui 2.3.5 should implement immediate compensating controls: (1) Restrict network access to the nginx-ui installation endpoint using firewall rules or reverse proxy authentication, limiting POST /api/install to trusted internal IP addresses only during initial setup (trade-off: requires manual network policy changes before each deployment). (2) Complete the installation process immediately upon deployment in a secured network segment before exposing the instance to broader network access (trade-off: may conflict with automated deployment workflows). (3) Deploy nginx-ui instances behind a VPN or bastion host during the initialization phase, only exposing the management interface after administrative credentials are established (trade-off: adds deployment complexity). (4) Implement network monitoring to detect unauthorized POST requests to /api/install endpoints during installation windows (trade-off: detective not preventive control). Monitor the GitHub security advisory GHSA-mxqh-q9h6-v8pq at https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq for future patch releases. Consider delaying new nginx-ui deployments until patched versions become available if installation window protection cannot be guaranteed.
Unauthenticated backup download and RCE in Nginx UI before 2.3.3. EPSS 1.0%. PoC available.
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 8.9), this vulnerability is remotel
Unauthenticated attackers can hijack the administrator account during nginx-ui's first-run installation window by claimi
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 7.7), this vulnerability is remotel
nginx-ui prior to version 2.3.8 exposes sensitive configuration values including node.secret via an authenticated GET /a
Nginx-UI is a web interface to manage Nginx configurations. Rated critical severity (CVSS 9.8), this vulnerability is re
Remote code execution as root in nginx-ui versions before 2.3.8 via unauthenticated backup restore within 10-minute star
Nginx-UI is a web interface to manage Nginx configurations. Rated high severity (CVSS 8.8), this vulnerability is remote
Disabled user accounts in Nginx UI versions before 2.3.4 retain full API access through previously issued JWT tokens for
Server-Side Request Forgery in Nginx UI (0xJacky/nginx-ui) version 2.3.4 and earlier lets any authenticated user coerce
nginx-ui versions prior to 2.3.8 expose 40+ protected configuration fields through the GetSettings API to authenticated
nginx-ui before version 2.3.5 allows Cross-Site WebSocket Hijacking (CSWSH) attacks due to improper WebSocket origin val
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today