CVE-2026-44015: Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44015?
CVE-2026-44015 has a high severity rating due to its potential for Server-Side Request Forgery allowing access to internal services.
How do I fix CVE-2026-44015?
To fix CVE-2026-44015, upgrade Nginx UI to version 2.3.5 or later where the vulnerability is patched.
Who is affected by CVE-2026-44015?
Users of Nginx UI versions 2.3.4 and earlier are affected by CVE-2026-44015.
What does CVE-2026-44015 allow an attacker to do?
CVE-2026-44015 allows an authenticated user to exploit Server-Side Request Forgery to access internal services.
Is authentication required to exploit CVE-2026-44015?
Yes, CVE-2026-44015 requires authentication as it can only be exploited by authenticated users.