CVE-2026-93964
Description
A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. Endpoint only processes and echoes back the certificate the caller submits (no stored data leaked); the real risk is unauthenticated openssl processing of attacker input. The project was informed of the problem early through an issue report but has not responded yet.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nginxproxymanager nginx-proxy-manager | 2.0, 2.1, 2.1.0, 2.1.1, 2.1.2, 2.2, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.3, 2.3.0, 2.3.1, 2.4, 2.4.0, 2.5, 2.5.0, 2.6, 2.6.0, 2.6.1, 2.6.2, 2.7, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.8, 2.8.0, 2.8.1, 2.9, 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 2.9.10, 2.9.11, 2.9.12, 2.9.13, 2.9.14, 2.9.15, 2.9.16, 2.9.17, 2.9.18, 2.9.19, 2.9.20, 2.9.21, 2.9.22, 2.10, 2.10.0, 2.10.1, 2.10.2, 2.10.3, 2.10.4, 2.11, 2.12, 2.13, 2.14.0, 2.15.0, 2.15.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.