EUVD-2026-27137
GHSA-mxqh-q9h6-v8pq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionGitHub Advisory
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
AnalysisAI
Unauthenticated bootstrap takeover in nginx-ui 2.3.5 allows remote attackers to hijack the initial installation process via crafted POST requests to /api/install endpoint. An attacker who successfully exploits the installation window gains full administrative control over the nginx-ui instance before legitimate administrators complete setup. No vendor-released patch identified at time of analysis, creating extended exposure risk for newly deployed instances.
Technical ContextAI
nginx-ui is a web-based management interface for the Nginx web server, providing administrative capabilities through a REST API. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), specifically affecting the bootstrap installation endpoint POST /api/install exposed during first-run configuration. The affected component (cpe:2.3:a:0xjacky:nginx-ui:*:*:*:*:*:*:*:*) fails to implement authentication checks during the critical initialization phase when administrative credentials are established. This represents a classic race condition window where the installation endpoint remains publicly accessible on the network before legitimate administrators complete the setup wizard. The underlying flaw allows arbitrary actors to invoke privileged installation functions that should be restricted to authorized first-time setup scenarios.
RemediationAI
No vendor-released patch identified at time of analysis per CVE description stating 'no public patches are available.' Organizations deploying nginx-ui 2.3.5 should implement immediate compensating controls: (1) Restrict network access to the nginx-ui installation endpoint using firewall rules or reverse proxy authentication, limiting POST /api/install to trusted internal IP addresses only during initial setup (trade-off: requires manual network policy changes before each deployment). (2) Complete the installation process immediately upon deployment in a secured network segment before exposing the instance to broader network access (trade-off: may conflict with automated deployment workflows). (3) Deploy nginx-ui instances behind a VPN or bastion host during the initialization phase, only exposing the management interface after administrative credentials are established (trade-off: adds deployment complexity). (4) Implement network monitoring to detect unauthorized POST requests to /api/install endpoints during installation windows (trade-off: detective not preventive control). Monitor the GitHub security advisory GHSA-mxqh-q9h6-v8pq at https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq for future patch releases. Consider delaying new nginx-ui deployments until patched versions become available if installation window protection cannot be guaranteed.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today