CVE-2026-102335: Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-09-30
Weakness: CWE-863

Description

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.

Affected products

NginxProxyManager nginx-proxy-manager: through 2.16.0

References

https://github.com/NginxProxyManager/nginx-proxy-manager
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/README.md#L36
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/user.js#L52-L62
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/templates/proxy_host.conf#L28
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5749
https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908
https://www.vulncheck.com/advisories/nginx-proxy-manager-through-2.16.0-improper-authorization-via-advanced-config

Get alerted when CVE-2026-102335 or the next vulnerability affects your stack