CVE-2026-42222 is a bootstrap takeover in Nginx UI version 2.3.5, scored CVSS 8.1 (high). An attacker who reaches a fresh instance during the setup window can claim it through POST /api/install. No patch was listed at publication, but 2.3.8 hardened the setup flow, so move to it.
What's affected
The NVD record names version 2.3.5. Its text says no public patches were available at publication. The advisory also lists 2.3.5 as affected with no patched version.
The same endpoint is the subject of CVE-2026-42221, whose advisory names 2.3.8 as the fix, and the 2.3.8 release notes say the first-run installation flow was hardened. I could not find a statement that ties 2.3.8 to this CVE by number, so confirm in the project's notes. Moving to 2.3.8 is still the sensible step.
How to check if you're exposed
- Check the version of every Nginx UI instance, including containers.
docker ps --filter ancestor=uozi/nginx-ui
- Check whether any instance has been started recently on a reachable network before setup was finished.
- Confirm the admin account is one you created.
What to do now
- Upgrade to Nginx UI 2.3.8 or later and read the project's advisory page for later fixes.
- Finish setup immediately after a new instance starts, from a trusted network.
- Keep fresh instances off the internet and off shared networks until setup is done.
- Rotate the admin credentials on any instance you are unsure about.
Why it matters
The classes are CWE-284, improper access control, and CWE-306, missing authentication for a critical function. The advisory says the setup request is accepted without authentication and sets the application's secrets, the certificate email and the first administrator.
The advisory is clear this is not a general takeover of installed systems. It matters most for new deployments, rebuilds, test environments and setups exposed on a local network. The KEV flag is false, and I found no report of exploitation in the wild.
Quick check
Is there a fixed version for CVE-2026-42222?
Not named for this CVE at publication. The related advisory for CVE-2026-42221 names 2.3.8, so use 2.3.8 or later and check the project advisory for updates.
Sources
Last reviewed: 19 October 2026.
