CVE-2026-44015
High
Description
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
SeverityHigh
CVSS8.5
Exploit probability—
ProductNginxui Nginx Ui
PublishedMay 12, 2026
First seenMay 12, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nginxui nginx_ui | v ≤ 2.3.4 | — |
| github.com/0xJacky/Nginx-UIGo | v ≤ 2.3.4, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.