EUVD-2026-27135
GHSA-h27v-ph7w-m9fp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.
AnalysisAI
Unauthenticated attackers can hijack the administrator account during nginx-ui's first-run installation window by claiming the /api/install endpoint before legitimate operators. This race-condition vulnerability in nginx-ui versions 2.0.0 through 2.3.7 bypasses authentication controls entirely, allowing complete instance takeover with attacker-controlled credentials. The request-encryption mechanism protects only transit confidentiality, not authorization. Attack complexity is rated HIGH due to the narrow time window between deployment and legitimate setup completion. EPSS data unavailable; no CISA KEV listing or public POC identified at time of analysis, but exploitation requires only standard HTTP tools and timing.
Technical ContextAI
Nginx UI (CPE: cpe:2.3:a:0xjacky:nginx-ui) is a web-based management interface for the Nginx web server. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function) in the installation initialization flow. The /api/install endpoint, designed for first-run setup, lacks authentication controls and accepts installation requests from any network-reachable source. While the implementation uses request encryption to protect credentials in transit, this cryptographic layer only ensures confidentiality-it does not verify that the requester is authorized to configure the instance. This design flaw creates a race condition where the first client to successfully invoke the endpoint gains permanent administrative access. The vulnerability exists in the initialization logic that transitions the application from unconfigured to production state without validating the legitimacy of the setup request.
RemediationAI
Upgrade immediately to nginx-ui version 2.3.8 or later, released by the vendor to address this vulnerability (https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8). Version 2.3.8 implements authentication controls on the /api/install endpoint to prevent unauthorized setup requests. For environments unable to upgrade immediately, implement network-level access controls to restrict the /api/install endpoint to trusted IP addresses during initial deployment-configure firewall rules or reverse proxy ACLs to block external access until setup is complete, then remove restrictions. Deploy new instances in isolated network segments unreachable from the internet during setup, completing configuration before exposing to production networks; this mitigation adds operational complexity to deployment pipelines but eliminates the race-condition window. Monitor authentication logs after any deployment to verify the configured administrator credentials match expected values; unauthorized account creation would indicate successful exploitation requiring immediate instance rebuild. For cloud or container deployments, use infrastructure-as-code to automate configuration immediately post-provisioning, minimizing the window of exposure to milliseconds rather than human-time intervals.
Unauthenticated backup download and RCE in Nginx UI before 2.3.3. EPSS 1.0%. PoC available.
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 8.9), this vulnerability is remotel
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 7.7), this vulnerability is remotel
nginx-ui prior to version 2.3.8 exposes sensitive configuration values including node.secret via an authenticated GET /a
Nginx-UI is a web interface to manage Nginx configurations. Rated critical severity (CVSS 9.8), this vulnerability is re
Remote code execution as root in nginx-ui versions before 2.3.8 via unauthenticated backup restore within 10-minute star
Nginx-UI is a web interface to manage Nginx configurations. Rated high severity (CVSS 8.8), this vulnerability is remote
Disabled user accounts in Nginx UI versions before 2.3.4 retain full API access through previously issued JWT tokens for
Server-Side Request Forgery in Nginx UI (0xJacky/nginx-ui) version 2.3.4 and earlier lets any authenticated user coerce
Unauthenticated bootstrap takeover in nginx-ui 2.3.5 allows remote attackers to hijack the initial installation process
nginx-ui versions prior to 2.3.8 expose 40+ protected configuration fields through the GetSettings API to authenticated
nginx-ui before version 2.3.5 allows Cross-Site WebSocket Hijacking (CSWSH) attacks due to improper WebSocket origin val
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today