CVE-2026-40519: Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()
Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:manage permission to execute arbitrary commands by storing a malicious payload in the dnsprovidercredentials field. The user-controlled dnsprovidercredentials value is interpolated directly into a shell command executed via childprocess.exec() without sanitization or escaping, causing the injected command to execute upon backend restart.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nginx Proxy Managerto a version that resolves this vulnerability.Patch a5db5ed - Compensating control
Temporarily restrict the account/permission that includes certificates:manage so only trusted users can access it, to reduce who can exploit the authenticated OS command injection in setupCertbotPlugins() (backend/setup.js).
- Operational
After applying the fix/commit, rotate or re-save any stored certificate/letsencrypt provider credentials that were in dns_provider_credentials, since a malicious payload could have been persisted and may execute on backend restart.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40519?
CVE-2026-40519 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-40519?
To fix CVE-2026-40519, update Nginx Proxy Manager to version 2.15.2 or later.
What versions of Nginx Proxy Manager are affected by CVE-2026-40519?
Nginx Proxy Manager versions 2.9.14 through 2.15.1 are affected by CVE-2026-40519.
What type of vulnerability is CVE-2026-40519?
CVE-2026-40519 is an authenticated remote code execution vulnerability due to OS command injection.
Who can exploit CVE-2026-40519?
Attackers with 'certificates:manage' permission can exploit CVE-2026-40519 to execute arbitrary commands.