CVE-2026-44015
HighSummary
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL.
Risk Assessment
An attacker can gain access to services bound to localhost or internal networks, bypassing network segmentation, which poses a serious security threat to the organization.
Recommendation
It is recommended to update Nginx UI to version 2.3.5 or later and implement appropriate security measures to restrict access to internal URLs.
Other vulnerabilities in Nginx UI
See all- CVE-2026-42222High
In version 2.3.5 of the Nginx user interface (nginx-ui), there is an unauthenticated bootstrap takeover vulnerability during the initial installation exposed by POST /api/install.
- CVE-2026-42221High
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window.
- CVE-2026-42238Critical
Nginx UI, a web user interface for the Nginx web server, prior to version 2.3.8, exposed a backup restore endpoint (POST /api/restore) that was completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker could upload a crafted backup archive that overwrote the application's configuration file and SQLite database.
Original NVD description (English source)
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.