Mohi@disismohi
CVE-2026-102335: Nginx Proxy Manager lets non-admin users inject arbitrary nginx directives. Here's what that means and how to contain it Wednesday.
2000039
81 followersView on X
CVE-2026-102335
LOWCVSS 7.1 · HIGHSignal is active with 2 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/NginxProxyManager/nginx-proxy-manager
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/README.md#L36
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/user.js#L52-L62
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/templates/proxy_host.conf#L28
- https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5749
Weakness type (CWE)
CWE-863
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 2 mentions across 1 observed day
What's happening
- 2 total mentions across 1 day
Deep dive
Activity timeline2 mentions / 1d
Referenced assets1 URL
By indicator
Full discourse2 posts
- Mohi@disismohi
Dangerous text fields (SQL, config DSLs, templates) are shell-equivalent. If a user can write nginx.conf, they own the proxy. Design RBAC accordingly. source: https://nvd.nist.gov/vuln/detail/CVE-2026-102335
000002381 followersView on X