CVE-2026-50892
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In Nginx Proxy Manager v2.14.0, incorrect access control in the 'Let's Encrypt' certificate download endpoint allows authenticated attackers to obtain TLS private key material via a crafted GET request.
Risk Assessment
The organization may be exposed to theft of TLS private keys, leading to serious security breaches and potential attacks on communications secured with those keys.
Recommendation
It is recommended to update Nginx Proxy Manager to the latest version and review and strengthen access controls for certificate download endpoints.
Other vulnerabilities in Nginx Proxy Manager v2.14.0
See all- CVE-2026-102335High
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
- CVE-2026-102334High
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
- CVE-2026-40519High
Nginx Proxy Manager versions 2.9.14 through 2.15.1 contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function. Attackers with certificates:manage permission can store a malicious payload in the dns_provider_credentials field, which is directly interpolated into a shell command without sanitization, leading to arbitrary command execution upon backend restart.
Original NVD description (English source)
Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers to obtain the TLS private key material via a crafted GET request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS