PT-2026-39184 · Nginx-Ui · Nginx-Ui

Miffyaa · Published 2026-04-29 · Updated 2026-05-14 · CVE-2026-44015

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.5

Description An authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node that points to an arbitrary internal URL and sending API requests with the X-Node-ID header. The Proxy middleware, specifically within the Proxy() function in internal/middleware/proxy.go, intercepts these requests and forwards them to the specified internal address without validating the node URL. This allows attackers to bypass network segmentation and access services bound to localhost, internal networks, or cloud metadata endpoints. The process involves retrieving the node secret from the '/api/settings' endpoint and creating a malicious node via the '/api/nodes' endpoint.

Recommendations Update to a version later than 2.3.4.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-06994

CVE-2026-44015

GHSA-WR32-99HH-6F35

Affected Products

Nginx-Ui

References · 10

• 🔥 https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35 · Exploit
• https://osv.dev/vulnerability/GHSA-wr32-99hh-6f35 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06994 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44015 · Security Note
• https://github.com/0xJacky/nginx-ui · Note
• https://twitter.com/CVEnew/status/2054324004962644338 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2054343420601127162 · Twitter Post
• https://t.me/cveNotify/163531 · Telegram Post
• https://t.me/CVEtracker/53550 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054460854720934354 · Twitter Post