CVE-2026-44015: Nginx UI allows attackers to access internal services

Summary

A user with a valid login to Nginx UI can potentially access internal services and data by exploiting a weakness in the way the system handles requests. This could allow unauthorized access to sensitive information or systems. To fix this, update to Nginx UI version 2.3.5 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
nginxui	nginx_ui	<= 2.3.4 `cpe:2.3:a:nginxui:nginx_ui::::::::`

Original title

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbit...

Original description

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.

nvd CVSS3.1 8.5

Vulnerability type

CWE-918 Server-Side Request Forgery (SSRF)

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35