High severity8.5GHSA Advisory· Published May 12, 2026· Updated May 14, 2026
CVE-2026-44015
CVE-2026-44015
Description
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35nvdExploitVendor Advisory
- github.com/advisories/GHSA-wr32-99hh-6f35ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-44015ghsa
News mentions
0No linked articles in our index yet.