NginxProxyManager vulnerabilities
We track 3 vulnerabilities in NginxProxyManager products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2026.
Latest NginxProxyManager vulnerabilities
- 7.1 High severity
nginx-proxy-manager: Incorrect Authorization
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives
- 7.4 High severity
nginx-proxy-manager: Improper Restriction of Excessive Authentication Attempts
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently gue
- 7.5 High severity
nginx-proxy-manager: Improper Neutralization of Special Elements used in an OS Command
Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:m