Server-Side Request Forgery (SSRF) in nginx-ui - CVE-2026-44015
Published: April 23, 2026
Vulnerability identifier: #VU127234
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-44015
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access internal services and disclose sensitive information.
The vulnerability exists due to server-side request forgery (SSRF) in the Proxy middleware when handling API requests with an attacker-controlled X-Node-ID header that references a crafted cluster node. A remote user can create a cluster node pointing to an arbitrary internal URL and send crafted API requests to access internal services and disclose sensitive information.
The issue can be used to reach localhost, private network services, and cloud metadata endpoints.
Affected software
nginx-ui
How to mitigate CVE-2026-44015
Install security update from vendor's website.
nginx-ui - update to 2.3.5