Is CVE-2026-44015 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44015 being exploited in the wild.

How severe is CVE-2026-44015?

High severity, with a CVSS score of 8.5, published 12 May 2026.

Which products and versions are affected?

0xJacky Nginx-UI <= 2.3.4; github.com/0xJacky/Nginx-UI (Go) <= 2.3.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.3.4.

Is there a fix for CVE-2026-44015?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44015 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44015?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44015: 0xJacky Nginx UI SSRF in Cluster Proxy Middleware

Q: Which products and versions are affected?

0xJacky Nginx-UI <= 2.3.4; github.com/0xJacky/Nginx-UI (Go) <= 2.3.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.3.4.

Q: Is there a fix for CVE-2026-44015?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44015 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44015?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44015 · Severity: high · CVSS 8.5 · Published 2026-05-12

Nginx UI is a web-based management interface for the Nginx web server. A security vulnerability allows logged-in users to force the server to make requests to internal systems that are normally protected by firewalls. This could allow an attacker to access sensitive internal data, steal cloud credentials from metadata services, or gain a foothold for further attacks on the internal network.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2026-44015 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44015 being exploited in the wild.
How severe is CVE-2026-44015?: High severity, with a CVSS score of 8.5, published 12 May 2026.
Which products and versions are affected?: 0xJacky Nginx-UI <= 2.3.4; github.com/0xJacky/Nginx-UI (Go) <= 2.3.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.3.4.
Is there a fix for CVE-2026-44015?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44015 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44015?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Nginx UI Cluster Proxy middleware (internal/middleware/proxy.go). Authenticated attackers can retrieve the 'node_secret' from the settings API and then create a malicious cluster node pointing to an internal URL (e.g., localhost, internal IPs, or cloud metadata endpoints). By sending subsequent API requests with the 'X-Node-ID' header set to the malicious node's ID, the Proxy middleware forwards the request to the attacker-specified internal address without validation. This allows for network segmentation bypass, internal port scanning, and potential remote code execution when combined with other vulnerabilities. As of the advisory date, no patched version has been identified.

Affected products

0xJacky Nginx UI <= 2.3.4

Identifiers

CVE-2026-44015
GHSA-wr32-99hh-6f35
GO-2026-5719

Timeline

2026-04-22: advisory: Original GitHub security advisory published
2026-05-12: disclosed: CVE published to NVD

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.