An authenticated user of Nginx UI can exploit a design flaw in the cluster proxy middleware. By creating a cluster node that points to an arbitrary internal URL and then sending API requests with the X-Node-ID header, the proxy forwards the request directly to the attacker‑specified address. The vulnerability, identified as CWE‑918, allows bypassing network segmentation and reaching services bound to localhost or other internal networks, effectively exposing sensitive internal resources.

The affected product is Nginx UI from 0xJacky. Versions 2.3.4 and earlier are vulnerable. Any deployment running these versions without applying updates is at risk.

The CVSS score of 8.5 indicates high severity. Because the flaw requires the attacker to be an authenticated user with permission to create cluster nodes, the attack vector is likely internal, but once authenticated the attacker can reach any internal endpoint. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the high CVSS combined with the potential for internal network exposure warrants immediate attention.