Which versions of nginx-ui are affected by CVE-2026-42238?

nginx-ui versions before 2.3.8 contain a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands with root privileges during the 10-minute…. A patch is available.

How to fix or mitigate CVE-2026-42238?

Within 24 hours: Identify all nginx-ui deployments and document current versions via inventory or container registry audit. Within 7 days: Upgrade all instances to nginx-ui 2.3.8 or later; restart containers/services post-upgrade. Within 30 days: Review and restrict network access to nginx-ui administrative interfaces using firewall rules or network segmentation to limit exposure during startup phases.

nginx-ui CVE-2026-42238

Q: What is the CVSS score of CVE-2026-42238?

CVE-2026-42238 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-27141 CRITICAL

Code Injection (CWE-94)

2026-05-04 GitHub_M

GHSA-4pvg-prr3-9cxr

Command Injection Nginx RCE Docker Code Injection

9.0

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 23:00 vuln.today

Patch available

May 04, 2026 - 22:17 EUVD

CVSS changed

May 04, 2026 - 21:22 NVD

9.0 (CRITICAL)

DescriptionGitHub Advisory

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file (app.ini) and SQLite database. Because the attacker controls the restored app.ini, they can inject an arbitrary OS command into the TestConfigCmd setting. After the application automatically restarts to apply the restored config, a single follow-up request triggers that command as the user running nginx-ui - typically root in Docker deployments. This issue has been patched in version 2.3.8.

AnalysisAI

Remote code execution as root in nginx-ui versions before 2.3.8 via unauthenticated backup restore within 10-minute startup window. Attackers exploit the completely unauthenticated /api/restore endpoint during initial installation to upload malicious backup archives that overwrite app.ini configuration with injected OS commands in TestConfigCmd setting. After automatic application restart, command injection triggers with privileges of the nginx-ui process - typically root in Docker deployments. EPSS data not available; no active exploitation reported but publicly disclosed via GitHub Security Advisory GHSA-4pvg-prr3-9cxr. Patch released in version 2.3.8.

Technical ContextAI

Nginx-ui (CPE: cpe:2.3:a:0xjacky:nginx-ui) is a web-based management interface for Nginx web servers, commonly deployed in Docker containers running as root. The vulnerability stems from CWE-94 (Improper Control of Generation of Code/Code Injection) in the backup restoration logic. During the first 10 minutes after fresh installation startup, the POST /api/restore endpoint lacks authentication enforcement entirely. The endpoint accepts backup archives containing app.ini configuration files and SQLite databases. The application's TestConfigCmd configuration parameter accepts arbitrary shell commands intended for Nginx configuration validation. By crafting a malicious backup archive with injected commands in the restored app.ini file, attackers achieve code injection. The application automatically restarts to apply restored configurations, executing the injected command string through the TestConfigCmd mechanism with the process owner's privileges.

RemediationAI

Immediately upgrade to nginx-ui version 2.3.8 or later, released by vendor at https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8. For environments unable to patch immediately, implement network-level access controls to restrict /api/restore endpoint access during the critical 10-minute startup window: configure reverse proxy or firewall rules to block unauthenticated POST requests to /api/restore from external networks, allowing access only from trusted management subnets. This mitigation adds operational complexity to legitimate backup restoration workflows and requires careful coordination during deployment windows. For Docker deployments, run nginx-ui container under a non-root user account with least-privilege principles to limit command injection impact scope, though this may affect Nginx management capabilities requiring elevated permissions. Monitor authentication logs for unexpected /api/restore access attempts during fresh installations. No other workaround eliminates the underlying authentication bypass - version upgrade is the definitive remediation.