The vulnerability in nginx-ui (<= 2.3.4) allows an authenticated user to perform SSRF by leveraging the cluster node configuration and the X-Node-ID header in API requests. The proxy middleware forwards these requests to attacker-specified internal addresses, enabling access to internal network services that would normally be inaccessible due to network segmentation. This can lead to unauthorized information disclosure and partial integrity impact. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. No official fix or mitigation has been published by the vendor as of the vulnerability's disclosure date.

Successful exploitation allows an authenticated user to bypass network segmentation and access internal or localhost services via SSRF. This can lead to high confidentiality impact by exposing sensitive internal resources. Integrity impact is low, and availability is not affected. The vulnerability requires authentication but no user interaction, and it can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to nginx-ui to trusted users only and monitor for suspicious API requests involving the X-Node-ID header. Consider network-level controls to limit nginx-ui's ability to reach internal services. Avoid exposing nginx-ui to untrusted networks.