CVE-2026-44015

Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Description

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.

Scores

Weaknesses (CWE)

• CWE-918

Advisories

• GHSA-wr32-99hh-6f35 — Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services
• GO-2026-5719 — Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services in github.com/0xJacky/Nginx-UI

European references

• ENISA EUVD · EUVD-2026-29837
• GCVE · GCVE-0-2026-44015

Affected configurations (NVD CPE)

• cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* ≤ 2.3.4

Affected products

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35

Sources