CVE-2026-42221 is an authentication flaw in Nginx UI, scored CVSS 8.1 (high) in the record. During the first-run window, anyone who reaches a fresh instance can claim the admin account. Upgrade to Nginx UI 2.3.8, and never leave a new install reachable from untrusted networks.
What's affected
The NVD record lists Nginx UI from 2.0.0 to before 2.3.8, and the advisory lists 2.0.0 to 2.3.5 with 2.3.8 as the patched version. The 2.3.8 release notes say the first-run installation flow was hardened.
The exposure is narrow. The instance must still be in its first-run state and inside the setup window, which the advisory says lasts ten minutes after startup. An already configured instance is not exposed to this one. Related issues CVE-2026-42222 and CVE-2026-42238 involve the same window, so read them too.
How to check if you're exposed
- Find out how many Nginx UI instances you run, including test, container and rebuilt ones. If you use Docker, list them.
docker ps --filter ancestor=uozi/nginx-ui
- Check the version in the web interface or your image tag, and compare it with 2.3.8.
- Ask whether any instance was started on a reachable network before an administrator finished setup. If you cannot tell, treat the admin account as untrusted and review it.
What to do now
- Upgrade to Nginx UI 2.3.8 or later.
- Complete the first-run setup right after starting a new instance, from a trusted network only.
- Do not publish the setup page. Bind it to an internal address or put it behind a VPN or an allow list.
- On existing instances, review the admin username, email and password, and rotate them if anything looks unexpected.
- Remember that a restart opens the window again on a fresh state, such as a rebuilt container without its data volume.
Why it matters
The class is CWE-306, missing authentication for a critical function. The advisory says the install endpoint is public and only checks whether the instance is already installed and whether ten minutes have passed. It does not check who is asking, and the request encryption only protects the content in transit.
An attacker who gets there first sets the admin account and the instance's secrets, so the takeover is permanent until someone resets it. Because the tool manages web server configuration, a captured instance puts the sites behind it at risk. The KEV flag is false, and I found no report of exploitation in the wild.
Try it yourself
A dynamic scan can flag setup and install endpoints that answer without authentication.
Click through it at your own pace, or open it full screen.
Quick check
Is my running, configured Nginx UI exposed?
Not to this flaw, since the problem is the first-run window. Upgrade anyway, because related flaws involve the same window and a restart.
Sources
Last reviewed: 19 October 2026.
