EUVD-2026-318687

fkie_cve-2026-44015

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.

GHSA-wr32-99hh-6f35 — Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services

Affected: Go: github.com/0xJacky/Nginx-UI

### Summary

An authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the `X-Node-ID` header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.

### Details

The nginx-ui Proxy middleware (`internal/middleware/proxy.go`) intercepts API requests containing an `X-Node-ID` header and forwards them to the URL of the corresponding cluster node. An attacker can:

1. Read the `node_secret` from `GET /api/settings` (accessible to any authenticated user) 2. Create a cluster node via `POST /api/nodes` pointing to any internal URL: ```json { "name": "ssrf_node", "url": "http://127.0.0.1:51820", "token": "<node_secret>", "enabled": true } ``` 3. Send any API request with the `X-Node-ID` header set to the created node's ID: ``` GET /api/settings HTTP/1.1 Authorization: <token> X-Node-ID: 1 ``` 4. The Proxy middleware forwards this request to `http://127.0.0.1:51820/api/settings`, making a server-side request to the internal address.

**Vulnerable code path:** - `internal/middleware/proxy.go` — `Proxy()`: no validation of the node URL; allows `127.0.0.1`, `localhost`, internal IPs, cloud metadata endpoints, etc.

The node URL is not restricted to external addresses or validated against an allowlist. Combined with the njs C…

WID-SEC-W-2026-1239 — nginx-ui: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in nginx-ui ausnutzen, um Informationen offenzulegen.

Most recent entries from all

bdu:2026-06994

EUVD-2026-318687

fkie_cve-2026-44015

GHSA-wr32-99hh-6f35 — Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services

WID-SEC-W-2026-1239 — nginx-ui: Schwachstelle ermöglicht Offenlegung von Informationen