CVE-2026-102335
HighCVSS 7.1Summary
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
Risk Assessment
A user with manage permissions could access files outside the intended scope or redirect traffic, potentially leading to data exposure or control over host routing.
Recommendation
Upgrade Nginx Proxy Manager beyond 2.16.0 if available and restrict the advanced_config field to administrators only. Additionally, review user permissions and audit existing configurations for unauthorized directives.
Other vulnerabilities in Nginx Proxy Manager
See all- CVE-2026-102334High
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
- CVE-2026-50892Medium
In Nginx Proxy Manager v2.14.0, incorrect access control in the 'Let's Encrypt' certificate download endpoint allows authenticated attackers to obtain TLS private key material via a crafted GET request.
- CVE-2026-40519High
Nginx Proxy Manager versions 2.9.14 through 2.15.1 contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function. Attackers with certificates:manage permission can store a malicious payload in the dns_provider_credentials field, which is directly interpolated into a shell command without sanitization, leading to arbitrary command execution upon backend restart.
Original NVD description (English source)
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS