{"id":"EUVD-2026-29837","enisaUuid":"f044612c-154a-3432-9c3d-8a3ec24dde74","description":"Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.","datePublished":"May 12, 2026, 8:49:16 PM","dateUpdated":"May 14, 2026, 9:32:37 PM","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35\n","aliases":"CVE-2026-44015\nGHSA-wr32-99hh-6f35\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"9f6a982a-cc3c-31a4-9236-4a4ecd301c11","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"≤ 2.3.4"}],"enisaIdVendor":[{"id":"f3045f03-d84e-3625-94d1-b41d8da824b3","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"3d29ab5e-2b73-3595-a44c-49a2cae2c711","vulnerability":{"id":"CVE-2026-44015","description":"Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.","datePublished":"May 12, 2026, 8:49:16 PM","dateUpdated":"May 14, 2026, 9:32:37 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35\n","enisa_id":"EUVD-2026-29837\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"a386e5a7-c3dd-3d5d-ba62-db72eb7c9520","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"≤ 2.3.4"}],"vulnerabilityVendor":[{"id":"ee1db502-e4ba-3c67-9b4c-aa1ce0c9a045","vendor":{"name":"0xJacky"}}]}},{"id":"f9fff26c-40e0-34b2-bc11-b25ab28611ac","vulnerability":{"id":"GHSA-wr32-99hh-6f35","description":"Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services","datePublished":"Apr 29, 2026, 8:54:54 PM","dateUpdated":"May 13, 2026, 4:31:42 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44015\nhttps://github.com/0xJacky/nginx-ui\n","enisa_id":"EUVD-2026-29837\n","aliases":"CVE-2026-44015\nGHSA-wr32-99hh-6f35\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}