# CVE-2026-44015: 0xJacky Nginx UI SSRF in Cluster Proxy Middleware

Source: https://junglewise.ai/threats/cve-2026-44015-0xjacky-nginx-ui-ssrf-in-cluster-proxy-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44015 · Severity: high · CVSS 8.5 · Published 2026-05-12

Nginx UI is a web-based management interface for the Nginx web server. A security vulnerability allows logged-in users to force the server to make requests to internal systems that are normally protected by firewalls. This could allow an attacker to access sensitive internal data, steal cloud credentials from metadata services, or gain a foothold for further attacks on the internal network.

Technologies: [0xJacky Nginx-UI](https://junglewise.ai/threats/technologies/nginx-ui), [github.com/0xJacky/Nginx-UI (Go)](https://junglewise.ai/threats/technologies/github-com-0xjacky-nginx-ui). Vendors: [0xJacky](https://junglewise.ai/threats/vendors/0xjacky), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44015 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44015 being exploited in the wild.

**How severe is CVE-2026-44015?** High severity, with a CVSS score of 8.5, published 12 May 2026.

**Which products and versions are affected?** 0xJacky Nginx-UI <= 2.3.4; github.com/0xJacky/Nginx-UI (Go) <= 2.3.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.3.4.

**Is there a fix for CVE-2026-44015?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44015 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44015?** Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Nginx UI Cluster Proxy middleware (internal/middleware/proxy.go). Authenticated attackers can retrieve the 'node_secret' from the settings API and then create a malicious cluster node pointing to an internal URL (e.g., localhost, internal IPs, or cloud metadata endpoints). By sending subsequent API requests with the 'X-Node-ID' header set to the malicious node's ID, the Proxy middleware forwards the request to the attacker-specified internal address without validation. This allows for network segmentation bypass, internal port scanning, and potential remote code execution when combined with other vulnerabilities. As of the advisory date, no patched version has been identified.

## Affected products

- 0xJacky Nginx UI <= 2.3.4

## Identifiers

- CVE-2026-44015
- GHSA-wr32-99hh-6f35
- GO-2026-5719

## Timeline

- 2026-04-22: advisory: Original GitHub security advisory published
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35](https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35)

## Related threats

- [Nginx UI Casdoor SSO login CSRF via constant state parameter](https://junglewise.ai/threats/cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter)
- [Nginx UI OTP secure-session step-up bypass via MCP](https://junglewise.ai/threats/cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp)
- [Nginx UI short token cache bypass after account re-enable](https://junglewise.ai/threats/cve-2026-84321-nginx-ui-standalone-short-tokens-survive-administrative)
- [Nginx UI auto backup path traversal in storage boundary](https://junglewise.ai/threats/cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated)
- [Nginx UI MCP configuration directive validation bypass](https://junglewise.ai/threats/cve-2026-84319-nginx-ui-mcp-configuration-tools-bypass-restricted-directive)