CVE-2026-44015 is a server side request forgery flaw (CVSS 8.5, high) in Nginx UI 2.3.4 and earlier. A logged in user can create a cluster node that points to an internal URL, then send requests with an X-Node-ID header that the server forwards. The advisory lists no patched version.
What's affected
The advisory lists Nginx UI 2.3.4 and earlier, with patched versions listed as none when it was written. Check the project's releases for a newer version.
An attacker needs a login, but any logged in user can do it. The advisory notes that the node secret is readable by any authenticated user.
How to check if you're exposed
- Find the Nginx UI version in the web interface or from your container image tag.
- Review which accounts can sign in and how they are protected.
- Look at the cluster node list for entries you did not create, especially URLs that point at localhost or internal addresses.
- Search logs for API calls that carry the X-Node-ID header.
What to do now
- Check the Nginx UI releases for a fixed version and upgrade when one exists.
- Remove cluster nodes you do not recognise.
- Limit access to Nginx UI to a VPN or admin network, and reduce the number of accounts.
- Use network rules so the host cannot reach internal services it does not need.
- Watch the project advisory page for updates.
Why it matters
The weakness is CWE-918, server side request forgery. The proxy middleware takes a node identifier from a header, looks up the node's URL, and forwards the request. Since users can create nodes with any URL, they decide where the server connects.
This can reach services bound to localhost or to the internal network, bypassing segmentation. Nginx UI usually holds powerful configuration rights, so keeping it off general networks matters. The KEV flag is false.
Quick check
Is a fix available?
The advisory lists patched versions as none. Check the project for a release newer than 2.3.4.
Sources
Last reviewed: 19 October 2026.
