Nginx UI
CVE-2026-44015
HIGH
GHSA-wr32-99hh-6f35
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Authenticated low-privilege API access gives PR:L with AC:L; the SSRF crosses into internal systems (S:C) exposing their data (C:H), with limited request-shaping integrity (I:L) and no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
AnalysisAI
Server-Side Request Forgery in Nginx UI (0xJacky/nginx-ui) version 2.3.4 and earlier lets any authenticated user coerce the server into making requests to arbitrary internal destinations. By reading the shared node_secret from GET /api/settings, registering a malicious cluster node via POST /api/nodes, and then setting the X-Node-ID header, an attacker makes the Proxy middleware forward requests to attacker-chosen addresses such as 127.0.0.1, internal networks, or cloud metadata endpoints. Publicly available exploit code exists and the flaw can be chained with a separate njs code-injection advisory to reach full RCE, though EPSS remains very low (0.03%, 8th percentile) and it is not listed in CISA KEV.
Technical ContextAI
Nginx UI is a Go-based web management interface for the Nginx web server that supports a multi-node cluster model. The root cause is CWE-918 (SSRF): the cluster Proxy middleware in internal/middleware/proxy.go intercepts any API request bearing an X-Node-ID header and forwards it to the URL registered for that cluster node, with no validation or allowlisting of the target. Because node creation (POST /api/nodes) accepts an arbitrary url field and the node_secret needed to authorize it is exposed to any authenticated user via GET /api/settings, an attacker can register a node pointing at localhost or RFC1918/link-local addresses. The affected package is go/github.com/0xJacky/Nginx-UI (CPE cpe:2.3:a:0xjacky:nginx-ui), and the design intent - proxying to remote cluster peers - is what makes the missing egress validation dangerous.
RemediationAI
No vendor-released patch version is identified at time of analysis (advisory GHSA-wr32-99hh-6f35 lists fixed-in as none), so monitor that advisory and upgrade to the first release above 2.3.4 as soon as it ships. As compensating controls, restrict who can reach the Nginx UI management interface by binding it to a trusted management network or placing it behind a VPN/reverse proxy with strict access control, since exploitation requires an authenticated account - tightening account provisioning and rotating the node_secret limits the attacker pool. Where the clustering feature is not used, disable or avoid registering cluster nodes and consider network egress filtering on the Nginx UI host to block outbound requests to 127.0.0.1-adjacent internal ranges and to the cloud metadata endpoint (169.254.169.254), accepting that egress filtering may interfere with legitimate cluster proxying. Because this SSRF can chain with the njs code-injection advisory to achieve RCE, prioritize patching both once fixes are available. Refer to https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35 and https://vuldb.com/vuln/363424.
Unauthenticated backup download and RCE in Nginx UI before 2.3.3. EPSS 1.0%. PoC available.
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 8.9), this vulnerability is remotel
Unauthenticated attackers can hijack the administrator account during nginx-ui's first-run installation window by claimi
Nginx UI is a web user interface for the Nginx web server. Rated high severity (CVSS 7.7), this vulnerability is remotel
nginx-ui prior to version 2.3.8 exposes sensitive configuration values including node.secret via an authenticated GET /a
Nginx-UI is a web interface to manage Nginx configurations. Rated critical severity (CVSS 9.8), this vulnerability is re
Remote code execution as root in nginx-ui versions before 2.3.8 via unauthenticated backup restore within 10-minute star
Nginx-UI is a web interface to manage Nginx configurations. Rated high severity (CVSS 8.8), this vulnerability is remote
Disabled user accounts in Nginx UI versions before 2.3.4 retain full API access through previously issued JWT tokens for
Unauthenticated bootstrap takeover in nginx-ui 2.3.5 allows remote attackers to hijack the initial installation process
nginx-ui versions prior to 2.3.8 expose 40+ protected configuration fields through the GetSettings API to authenticated
nginx-ui before version 2.3.5 allows Cross-Site WebSocket Hijacking (CSWSH) attacks due to improper WebSocket origin val
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today