CVE-2026-44015: Nginxui Nginx UI SSRF Vulnerability

CVE-2026-44015 Overview

CVE-2026-44015 is a Server-Side Request Forgery (SSRF) vulnerability in Nginx UI, a web user interface for the Nginx web server. The flaw affects version 2.3.4 and earlier. An authenticated user can create a cluster node pointing to an arbitrary internal URL. By sending API requests with the X-Node-ID header, the Proxy middleware forwards those requests to the attacker-specified internal address. This bypasses network segmentation and exposes services bound to localhost or internal networks. The vulnerability is tracked under CWE-918 and carries a CVSS 3.1 score of 9.9.

Critical Impact
Authenticated attackers can pivot through Nginx UI to reach internal services, breach network segmentation, and access localhost-bound applications.

Affected Products

Nginx UI version 2.3.4
All Nginx UI versions prior to 2.3.4
Deployments exposing the Nginx UI Proxy middleware

Discovery Timeline

2026-05-12 - CVE-2026-44015 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-44015

Vulnerability Analysis

Nginx UI supports a cluster mode where administrators register additional nodes for distributed management. Each registered node is identified by a node ID. When a client sends an API request containing the X-Node-ID header, the Proxy middleware forwards the request to the URL associated with that node. The middleware does not validate whether the destination URL points to internal or restricted address ranges. An authenticated user can register a cluster node whose URL targets any host reachable from the Nginx UI server. This includes 127.0.0.1, link-local addresses, cloud metadata endpoints, and private subnets. Once registered, the attacker triggers proxied requests by setting the X-Node-ID header to the malicious node identifier.

Root Cause

The root cause is missing destination validation in the Proxy middleware that handles X-Node-ID routing. The middleware trusts user-supplied cluster node configuration and forwards requests without applying an allowlist, blocklist, or address-family check. This pattern matches CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires authenticated access to Nginx UI. The attacker performs two steps. First, the attacker calls the cluster node creation API to register a node whose URL points to an internal target such as http://127.0.0.1:6379 or a cloud metadata service. Second, the attacker issues any proxied API request with the X-Node-ID header set to the malicious node ID. The Nginx UI server then issues outbound HTTP requests to the attacker-controlled destination on behalf of the authenticated session. Refer to the GitHub Security Advisory GHSA-wr32-99hh-6f35 for additional context.

Detection Methods for CVE-2026-44015

Indicators of Compromise

Cluster node entries in Nginx UI configuration referencing loopback addresses, RFC1918 ranges, or cloud metadata endpoints such as 169.254.169.254
Outbound HTTP connections from the Nginx UI process to internal hosts that are not part of legitimate cluster topology
API requests containing unexpected X-Node-ID header values originating from non-administrative accounts

Detection Strategies

Audit the Nginx UI cluster node table and alert on any node URL pointing to private, loopback, or metadata addresses
Inspect Nginx UI access and application logs for X-Node-ID header use correlated with cluster node creation events
Monitor egress traffic from the Nginx UI host and flag connections to internal services that the host does not normally contact

Monitoring Recommendations

Enable verbose logging of cluster management API calls including node creation, modification, and deletion
Forward Nginx UI logs to a centralized logging platform and build alerts on SSRF patterns
Track authentication events to identify which accounts register new cluster nodes

How to Mitigate CVE-2026-44015

Immediate Actions Required

Upgrade Nginx UI to a release later than 2.3.4 once the vendor publishes a fixed version
Restrict access to the Nginx UI administrative interface to trusted networks and administrators
Review existing cluster node definitions and remove any entries pointing to internal or loopback addresses
Rotate Nginx UI credentials and audit account activity for unauthorized node registrations

Patch Information

The vendor advisory GHSA-wr32-99hh-6f35 tracks the fix. Administrators should monitor the advisory and the project release notes for a patched version above 2.3.4 and apply it as soon as it is available.

Workarounds

Place Nginx UI behind a reverse proxy or firewall that blocks outbound connections from the Nginx UI host to internal services
Disable cluster functionality if it is not required in the deployment
Apply egress filtering that denies the Nginx UI process from reaching loopback, RFC1918, and cloud metadata addresses

bash

# Example egress filtering on the Nginx UI host using iptables
# Block the Nginx UI service user from reaching internal targets
iptables -A OUTPUT -m owner --uid-owner nginx-ui -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nginx-ui -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nginx-ui -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nginx-ui -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nginx-ui -d 169.254.169.254 -j REJECT