CVE-2026-102335 in Nginx Proxy Manager
Summary
by MITRE • 09/29/2026
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Nginx Proxy Manager versions up to 2.16.0 represents a critical authorization failure that undermines the security boundaries of the application's administrative controls. The core issue lies in the improper restriction of access to the advanced_config field, which is intended for high-level system configuration by administrators only. In this flawed implementation, users possessing manage permissions are able to interact with and modify these advanced settings without requiring elevated privileges. This breakdown in role-based access control allows lower-privileged actors to execute actions that should be strictly reserved for system administrators, effectively bypassing the intended security model of the proxy management interface.
From a technical perspective, this authorization flaw enables non-admin users to inject arbitrary Nginx directives into their assigned host configurations. The advanced_config field serves as an entry point where raw configuration syntax is processed and applied by the underlying Nginx web server. By allowing unprivileged users to write custom directives, attackers can manipulate how Nginx handles requests for specific hosts. This capability transforms a standard proxy management tool into a vector for deeper system compromise, as the injected code executes with the privileges of the user running the Nginx process, which is often root or a highly privileged service account depending on the deployment configuration.
The operational impact of this vulnerability is severe and multifaceted. Attackers can exploit the ability to inject arbitrary directives such as alias or proxy_pass to serve files from locations outside the intended web root, leading to unauthorized file disclosure. This mechanism allows for the exfiltration of sensitive data stored within the server's filesystem that would otherwise be inaccessible through normal application routes. Furthermore, attackers can control routing logic to redirect traffic to malicious external servers, facilitating phishing attacks or man-in-the-middle scenarios where user credentials and session tokens could be intercepted. The ability to alter routing also means an attacker could potentially bypass existing security headers or access controls configured at the proxy level for other services behind Nginx.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as it involves a failure to enforce proper roles and permissions within the application logic. Additionally, from the perspective of the MITRE ATT&CK framework, this flaw facilitates lateral movement and privilege escalation by allowing an attacker to leverage their initial access through manage permissions to gain deeper control over the infrastructure. The injection of arbitrary configuration directives is akin to CWE-94, Improper Control of Generation of Code (Code Injection), as it involves injecting executable logic into a system component that interprets such code during request processing.
To mitigate this risk, immediate action should be taken by upgrading Nginx Proxy Manager to version 2.16.1 or later, where the access controls for the advanced_config field have been corrected to restrict modifications exclusively to administrators with appropriate privileges. In environments where an upgrade is not immediately feasible, network-level segmentation can provide a temporary layer of defense by restricting access to the management interface only from trusted administrative networks. Additionally, implementing strict input validation and sanitization on any custom configuration fields within proxy applications is recommended as a broader security best practice to prevent similar injection vulnerabilities in other components or future versions. Regular auditing of user permissions and reviewing role assignments can also help identify and remediate over-privileged accounts that might be exploited through such authorization flaws.