What’s Vulnerable › Vulnerabilities

CVE-2026-50892

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-15 · updated 2026-06-17
• Weakness: CWE-284

Description

Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers to obtain the TLS private key material via a crafted GET request.

References

• https://gist.github.com/pyuysig/2a581564816d0f9240a03bc2d5ce7356
• https://gist.github.com/pyuysig/2a581564816d0f9240a03bc2d5ce7356

Get alerted when CVE-2026-50892 or the next vulnerability affects your stack