{"action":"Upgrade github.com/0xJacky/Nginx-UI to 2.3.8 or later.","affected":[{"fixed":"2.3.8","introduced":"2.0.0"}],"component":"github.com/0xJacky/Nginx-UI","cve_ids":["CVE-2026-42221"],"ecosystem":"Go","epss":0.01342,"exploited":false,"fixed_versions":["2.3.8"],"ghsa_id":"GHSA-h27v-ph7w-m9fp","id":"tcs_01M5KFBPMHVSP1A8A4JR6AWD01","modified_at":"2026-06-25T23:11:04.578182544Z","published_at":"2026-05-06T16:59:00Z","references":["https://osv.dev/vulnerability/GHSA-h27v-ph7w-m9fp","https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp","https://nvd.nist.gov/vuln/detail/CVE-2026-42221","https://github.com/0xJacky/nginx-ui","https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-h27v-ph7w-m9fp","url":"https://osv.dev/vulnerability/GHSA-h27v-ph7w-m9fp"}],"summary":"Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim"}