CVE-2026-42221

Go/github.com/0xJacky/Nginx-UI CVE-2026-42221: high 8.1, EPSS 1.60%

Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

Action: Upgrade github.com/0xJacky/Nginx-UI to 2.3.8 or later.

go get github.com/0xJacky/Nginx-UI@v2.3.8

Affected

Fixed versions

Sources

• osv: GHSA-h27v-ph7w-m9fp
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp
• https://nvd.nist.gov/vuln/detail/CVE-2026-42221
• https://github.com/0xJacky/nginx-ui
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8

CVE-2026-42221 · published 2026-05-06T16:59:00Z · modified 2026-06-25T23:11:04.578182544Z · JSON

Go/github.com/0xJacky/Nginx-UI CVE-2026-42221: unknown, EPSS 1.60%

Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5412
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp
• https://nvd.nist.gov/vuln/detail/CVE-2026-42221
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8

CVE-2026-42221 · published 2026-06-25T22:34:31Z · modified 2026-06-25T23:00:54.621523594Z · JSON