https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:38:32.830649+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-06341 bdu:2026-06341 2026-10-03T23:38:32.964842+00:00 bdu:2026-06341 https://cve.radiocsirt.org/vuln/euvd-2026-308702 EUVD-2026-308702 2026-10-03T23:38:32.964886+00:00 EUVD-2026-308702 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42222 fkie_cve-2026-42222 2026-10-03T23:38:32.964901+00:00

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.

 https://cve.radiocsirt.org/vuln/ghsa-mxqh-q9h6-v8pq GHSA-mxqh-q9h6-v8pq — Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover 2026-10-03T23:38:32.964933+00:00

Affected: Go: github.com/0xJacky/nginx-ui

## Summary

An unauthenticated bootstrap takeover exists in `nginx-ui` during the initial installation window exposed by `POST /api/install`.

When the instance is still uninitialized, `POST /api/install` is reachable without authentication and accepts attacker-controlled bootstrap data. The handler sets the application's JWT secret, the node secret, the certificate email, and the initial administrator username and password. This allows an attacker who can reach a fresh instance during the initial 10-minute setup window to claim the installation before the legitimate operator.

This is not a general post-install takeover. The exposure condition is narrower: the target must still be in its first-run state and still be within the initial setup window. In practice, this makes the issue most relevant during initial deployment, rebuilds, ephemeral test environments, LAN-accessible fresh installs, or temporarily exposed setup workflows.

The primary attack path is direct network access to a reachable fresh instance.[^cors]

This was reproduced over HTTP against live local instances started from `nginx-ui` `v2.3.5` using Docker image `uozi/nginx-ui@sha256:d73343e3009c9b558129a2be0cacd6c2c57ed8006a5871873b874b812e612e5a` (`org.opencontainers.image.version=2.3.5`, revision `1a9cd29a308278173aa0f16234cb78061dd2bd42`).

## Impact

This issue allows full unauthenticated takeover of a fresh `nginx-ui` instance during the initial installation window.

The practical exposure window is limi…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1276 WID-SEC-W-2026-1276 — nginx-ui: Mehrere Schwachstellen 2026-10-03T23:38:32.965001+00:00

Ein Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um beliebigen Code mit Root-Rechten auszuführen, sich Administratorrechte zu verschaffen und die vollständige Kontrolle über das System zu erlangen oder vertrauliche Informationen offenzulegen.