Nginx UI EUVD-2026-27137

Exploitation requires the target nginx-ui 2.3.5 instance to be in its first-run, still-uninitialized state AND still within the initial setup window (~10 minutes per the advisory), with the attacker able to reach POST /api/install over the network. No credentials or user interaction are needed within that window - the handler accepts attacker-controlled bootstrap data and sets the JWT secret, node secret, certificate email, and initial admin username/password. LIMITING FACTORS: the vulnerable state is transient (only during initial deployment, rebuilds, ephemeral/test environments, LAN-accessible fresh installs, or temporarily exposed setup workflows); once a legitimate operator or anyone completes install, the window closes (GET /api/install returns lock:true). The advisory notes OPTIONS /api/install returned Access-Control-Allow-Origin: * (possible browser-assisted cross-origin path in some layouts) but states this is not required and the primary path is direct network access. There is no persistent post-install exposure.

Signals are strongly divided, which is the central feature of this CVE. CVSS 3.1 rates it 9.8 Critical (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) and the vuln.today Decision label is act_now with SSVC Technical Impact: total, reflecting that successful exploitation yields complete administrative takeover of the instance plus control of the application's trust material (JWT secret, node secret, admin credentials). Against that, EPSS is only 0.04% (12th percentile), SSVC Automatable: no, the CVE is NOT in CISA KEV, and exploitation is gated by a narrow precondition: the target must be a fresh, still-uninitialized instance within its initial ~10-minute setup window. These conflict: the raw CVSS treats this as broadly network-exploitable with low complexity, but the real-world exposure is a transient first-boot state, not a persistent condition - so the practical attack surface is far smaller than 9.8 alone implies. The low EPSS is consistent with this (no evidence of widespread automated exploitation), while the act_now label and a published, live-reproduced PoC justify urgent action specifically for operators performing or exposing fresh installs. Net: this is a genuine high-severity issue during deployment/rebuild/ephemeral-test windows, but not a mass-exploitable always-on flaw; prioritize for anyone standing up or re-imaging nginx-ui 2.3.5, while recognizing EPSS/KEV signals indicate no observed widespread exploitation to date.

An attacker with network reachability to a freshly deployed nginx-ui 2.3.5 instance that has not yet been initialized sends a crafted POST /api/install before the legitimate operator finishes setup, supplying their own admin username, password, and certificate email. Because the endpoint requires no authentication during the first-run window, the installation locks under attacker-chosen credentials and secrets, and the attacker immediately logs in as the sole administrator. A full, standalone working PoC (bash/curl/openssl) is published in the vendor GHSA advisory and was reproduced live against the v2.3.5 Docker image, so exploitation does not require developing new tooling.