CVE-2026-102335: Nginx Proxy Manager Auth Bypass Vulnerability

CVE-2026-102335 Overview

CVE-2026-102335 is an improper authorization vulnerability [CWE-863] in Nginx Proxy Manager through version 2.16.0. The application fails to restrict the advanced_config field to administrators. Non-admin users holding manage permissions can inject arbitrary nginx directives into proxy host configurations. Attackers abuse this access to inject directives such as alias to serve arbitrary files from the host or to alter routing for hosts they control.

Critical Impact

Authenticated low-privilege users can inject arbitrary nginx directives, enabling arbitrary file disclosure and manipulation of routing on assigned hosts.

Affected Products

• Nginx Proxy Manager versions through 2.16.0
• Deployments exposing the management UI or API to non-admin users with manage permissions
• Multi-tenant Nginx Proxy Manager installations where hosts are delegated to non-admin operators

Discovery Timeline

• 2026-09-28 - CVE-2026-102335 published to the National Vulnerability Database (NVD)
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102335

Vulnerability Analysis

Nginx Proxy Manager provides a web interface for managing nginx reverse proxy hosts. The application supports a role model that distinguishes administrators from users who receive manage permissions on specific hosts. Each proxy host configuration includes an advanced_config field that is rendered directly into the generated nginx server block from the template at backend/templates/proxy_host.conf.

The backend authorization logic, implemented in backend/internal/user.js, does not gate writes to advanced_config behind the administrator role. Any user permitted to create or edit a proxy host can supply arbitrary nginx configuration text. That text is emitted verbatim inside the server { } block that nginx loads at reload.

An attacker with manage access can inject directives such as alias, root, return, or rewrite to expose files outside the intended proxy scope or hijack request routing. Because nginx workers run with access to the host filesystem, injected alias /etc/ style directives can disclose sensitive files such as configuration or credential material readable by the nginx process.

Root Cause

The defect is a missing authorization check on a privileged configuration field. The permission model treats manage on a host as sufficient to modify every attribute of that host, including a free-form field that maps directly to server-level nginx directives. The template concatenates advanced_config into the rendered configuration without validation, filtering, or a directive allowlist.

Attack Vector

Exploitation requires an authenticated account with manage permissions on at least one proxy host and network access to the Nginx Proxy Manager API or UI. The attacker submits a proxy host update containing crafted nginx directives inside advanced_config. On save, Nginx Proxy Manager writes the rendered configuration and reloads nginx. The injected directives then take effect for subsequent requests to hosts the attacker controls, enabling arbitrary file serving or routing manipulation. See the VulnCheck advisory and Nginx Proxy Manager Issue #5749 for further technical detail.

// No verified public proof-of-concept code is available.
// Refer to the linked advisory and issue tracker for reproduction details.

Detection Methods for CVE-2026-102335

Indicators of Compromise

• Proxy host records where the advanced_config field contains directives such as alias, root, return, rewrite, proxy_pass, or location blocks that were authored by non-admin accounts.
• Nginx access logs showing requests to paths outside the expected application namespace, particularly requests that successfully return filesystem content.
• Audit log entries showing proxy host edits by users without administrator role, followed by nginx reloads.

Detection Strategies

• Review the Nginx Proxy Manager database for advanced_config values on all proxy hosts and compare authorship to administrator group membership.
• Diff currently rendered nginx configuration files against a known-good baseline to identify unexpected directives inside server blocks.
• Correlate API calls to the proxy host update endpoint with the authenticated user role to flag non-admin modifications of advanced_config.

Monitoring Recommendations

• Alert on any nginx configuration change that introduces alias or root directives pointing outside the intended web root.
• Monitor for nginx reload events initiated by Nginx Proxy Manager immediately following edits by non-admin accounts.
• Log and retain the full body of proxy host create and update requests for forensic review.

How to Mitigate CVE-2026-102335

Immediate Actions Required

• Restrict the manage permission to trusted administrators until a fixed release is deployed.
• Audit all existing proxy hosts for advanced_config content and remove unrecognized directives.
• Limit network access to the Nginx Proxy Manager management interface to trusted operators.

Patch Information

A fix is tracked in Nginx Proxy Manager Pull Request #5908 against the Nginx Proxy Manager repository. Operators should upgrade to a release that includes this pull request and enforces administrator-only access to the advanced_config field. Consult the VulnCheck advisory for current version guidance.

Workarounds

• Remove manage permissions from all non-administrator users until upgraded.
• Run Nginx Proxy Manager under a service account whose filesystem read scope is limited to required web content and certificate directories, reducing the impact of injected alias directives.
• Place the management interface behind an authenticated reverse proxy or VPN so only administrators can reach the API.

# Example: identify non-admin authored advanced_config entries in the SQLite database
sqlite3 /data/database.sqlite \
  "SELECT ph.id, ph.owner_user_id, u.roles, ph.advanced_config \
   FROM proxy_host ph JOIN user u ON u.id = ph.owner_user_id \
   WHERE length(ph.advanced_config) > 0;"