The vulnerability CVE-2026-42222 affects nginx-ui version 2.3.5 by allowing unauthenticated access to a critical installation function through the POST /api/install endpoint during the initial setup window. This missing authentication (CWE-306) enables an attacker to take over the bootstrap process, potentially compromising the system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patches or vendor advisories indicating remediation are currently available.

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized control over the nginx-ui installation process, leading to full compromise of the affected system's confidentiality, integrity, and availability. Since the vulnerability occurs during the initial installation window, systems that are exposed during this phase are at risk. No known exploits are reported in the wild at this time.

No official patches or fixes are currently available for this vulnerability. Users should avoid exposing the nginx-ui installation interface to untrusted networks during the initial setup phase. Monitor vendor communications for updates and apply any future patches promptly once released. Restrict network access to the installation endpoint until a fix is available.