nginx-ui CVE-2026-42238

Requires nginx-ui fresh installation within first 10 minutes after process startup before any authentication mechanisms are configured - this is the specific deployment state where /api/restore endpoint lacks authentication enforcement entirely. Attack vector is network-based (AV:N) requiring HTTP/HTTPS access to the nginx-ui management interface from attacker-controlled network position. No authentication credentials required (PR:N) during vulnerability window. User interaction required (UI:P) in form of triggering follow-up request after malicious backup restoration to execute injected TestConfigCmd. Exploitation limited to versions before 2.3.8. Highest impact in Docker deployments running nginx-ui process as root user. Does NOT affect installations past initial 10-minute window or those with network access controls blocking external /api/restore requests.

Real-world risk is HIGH despite narrow exploitation window. CVSS 4.0 score of 9.0 reflects network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but attack timing constraints (AT:P). The 10-minute unauthenticated window exists ONLY on fresh installations, significantly limiting exposure compared to persistent vulnerabilities. However, impact is CRITICAL when exploitable: complete system compromise (VC:H/VI:H/VA:H) with scope change to underlying infrastructure (SC:H/SI:H/SA:H), especially in Docker environments where nginx-ui typically runs as root. The attack requires user interaction (UI:P) to trigger command execution via follow-up request after restore, adding minor friction. No EPSS score available for probability assessment. No CISA KEV listing indicates exploitation has not been observed at scale in the wild. GitHub Security Advisory disclosure suggests vendor-coordinated release rather than active exploitation discovery. Primary risk scenario: attackers scanning for newly deployed nginx-ui instances during the vulnerability window, though automated exploitation at scale is constrained by timing requirements. Organizations with frequent fresh deployments face elevated exposure.

Attacker scans IPv4 ranges for newly deployed nginx-ui instances exposing port 80/443 to internet. Upon discovering a fresh installation within its 10-minute unauthenticated window, attacker crafts a malicious backup archive containing app.ini with TestConfigCmd set to reverse shell command. Attacker POSTs this archive to /api/restore endpoint without credentials. Nginx-ui automatically restarts to apply restored configuration. Attacker sends single request triggering TestConfigCmd execution, establishing remote shell as root on Docker host. No public proof-of-concept code confirmed in references, but attack primitive is straightforward given detailed advisory disclosure.