https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:09:56 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-06341 bdu:2026-06341 https://cve.radiocsirt.org/vuln/bdu:2026-06341 https://cve.radiocsirt.org/vuln/euvd-2026-308702 EUVD-2026-308702 https://cve.radiocsirt.org/vuln/euvd-2026-308702 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42222 <p>Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.</p> <p>Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42222 https://cve.radiocsirt.org/vuln/ghsa-mxqh-q9h6-v8pq <p><strong>Affected:</strong> Go: github.com/0xJacky/nginx-ui</p> <p>## Summary</p> <p>An unauthenticated bootstrap takeover exists in `nginx-ui` during the initial installation window exposed by `POST /api/install`.</p> <p>When the instance is still uninitialized, `POST /api/install` is reachable without authentication and accepts attacker-controlled bootstrap data. The handler sets the application&#39;s JWT secret, the node secret, the certificate email, and the initial administrator username and password. This allows an attacker who can reach a fresh instance during the initial 10-minute setup window to claim the installation before the legitimate operator.</p> <p>This is not a general post-install takeover. The exposure condition is narrower: the target must still be in its first-run state and still be within the initial setup window. In practice, this makes the issue most relevant during initial deployment, rebuilds, ephemeral test environments, LAN-accessible fresh installs, or temporarily exposed setup workflows.</p> <p>The primary attack path is direct network access to a reachable fresh instance.[^cors]</p> <p>This was reproduced over HTTP against live local instances started from `nginx-ui` `v2.3.5` using Docker image `uozi/nginx-ui@sha256:d73343e3009c9b558129a2be0cacd6c2c57ed8006a5871873b874b812e612e5a` (`org.opencontainers.image.version=2.3.5`, revision `1a9cd29a308278173aa0f16234cb78061dd2bd42`).</p> <p>## Impact</p> <p>This issue allows full unauthenticated takeover of a fresh `nginx-ui` instance during the initial installation window.</p> <p>The practical exposure window is limi…</p> <p><strong>Affected:</strong> Go: github.com/0xJacky/nginx-ui</p> <p>## Summary</p> <p>An unauthenticated bootstrap takeover exists in `nginx-ui` during the initial installation window exposed by `POST /api/install`.</p> <p>When the instance is still uninitialized, `POST /api/install` is reachable without authentication and accepts attacker-controlled bootstrap data. The handler sets the application&#39;s JWT secret, the node secret, the certificate email, and the initial administrator username and password. This allows an attacker who can reach a fresh instance during the initial 10-minute setup window to claim the installation before the legitimate operator.</p> <p>This is not a general post-install takeover. The exposure condition is narrower: the target must still be in its first-run state and still be within the initial setup window. In practice, this makes the issue most relevant during initial deployment, rebuilds, ephemeral test environments, LAN-accessible fresh installs, or temporarily exposed setup workflows.</p> <p>The primary attack path is direct network access to a reachable fresh instance.[^cors]</p> <p>This was reproduced over HTTP against live local instances started from `nginx-ui` `v2.3.5` using Docker image `uozi/nginx-ui@sha256:d73343e3009c9b558129a2be0cacd6c2c57ed8006a5871873b874b812e612e5a` (`org.opencontainers.image.version=2.3.5`, revision `1a9cd29a308278173aa0f16234cb78061dd2bd42`).</p> <p>## Impact</p> <p>This issue allows full unauthenticated takeover of a fresh `nginx-ui` instance during the initial installation window.</p> <p>The practical exposure window is limi…</p> https://cve.radiocsirt.org/vuln/ghsa-mxqh-q9h6-v8pq https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1276 <p>Ein Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um beliebigen Code mit Root-Rechten auszuführen, sich Administratorrechte zu verschaffen und die vollständige Kontrolle über das System zu erlangen oder vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um beliebigen Code mit Root-Rechten auszuführen, sich Administratorrechte zu verschaffen und die vollständige Kontrolle über das System zu erlangen oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1276