CVE-2026-42238 is a remote code execution flaw in Nginx UI, scored CVSS 9.8 (critical) in the record. The backup restore endpoint needs no login for the first 10 minutes after the process starts. Upgrade to Nginx UI 2.3.8, and keep the service off untrusted networks until it is updated.
What's affected
The advisory and the NVD record list Nginx UI before 2.3.8, with 2.3.8 as the patched version. The release notes for 2.3.8 describe a hardened first-run installation flow.
This flaw reaches further than the setup page. The advisory says the ten minute window resets every time the process restarts, so a container restart, an upgrade or a health check restart can reopen it, not only the first deployment. The advisory also notes that the service often runs as root in Docker deployments.
How to check if you're exposed
- Find your instances and their versions.
docker ps --filter ancestor=uozi/nginx-ui
docker inspect --format '{{ .Config.Image }}' YOUR_CONTAINER
- Compare the version with 2.3.8. Anything older is affected.
- Check who can reach the service's port. Any network path from untrusted users is a risk, since the window opens on each start.
- Look at how the service restarts. Restart policies and health checks open the window repeatedly.
What to do now
- Upgrade to Nginx UI 2.3.8 or later.
- Until then, limit access to the service to a management network, a VPN or an allow list. This matters most right after any restart.
- Check the application's configuration file and database for changes you did not make, especially command settings, and restore known good copies.
- If a restart happened while the service was reachable by untrusted hosts, treat the host as possibly compromised and review it.
- Run the service as a non-root user where your deployment allows it.
Why it matters
The class is CWE-94, improper control of generation of code. The advisory describes a chain. The restore route has no authentication inside the window. The restore can overwrite the configuration file and database. A command setting in that file is then run after the automatic restart.
The advisory notes that the check on the backup's integrity uses a key supplied by the same caller, so it does not stop a forged archive. The result is a command running as the service user, which is why one open window on a web server manager is serious. The KEV flag is false, and I found no report of exploitation in the wild.
Tools that manage your web server sit close to your most exposed systems. Keep an inventory of them, and run the free in-browser dependency scan on your own projects to see what else is out of date.
Quick check
Why does a restart matter?
The advisory says the unauthenticated window restarts with the process, so any restart can reopen it, not only the first install.
Sources
Last reviewed: 19 October 2026.
