CVE-2026-44015 - Vulnerability Analysis

Overview

Nginx UI <= 2.3.4 contains a server-side request forgery caused by forwarding API requests with attacker-controlled X-Node-ID header to internal URLs, letting authenticated users bypass network segmentation and access internal services.

Severity & Score

Impact

Authenticated users can bypass network segmentation to access internal services bound to localhost or internal networks.

Mitigation

Update to a version later than 2.3.4 or the latest available version.

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner