CVE-2026-50892: Medium severity Nginx Proxy Manager Nginx Proxy Manager vulnerability
Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers to obtain the TLS private key material via a crafted GET request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or tighten access control on the Let's Encrypt certificate download endpoint so that non-authorized users cannot download certificate private keys. Ensure only fully trusted administrators may access this endpoint (or disable the endpoint entirely if not required).
Nginx Proxy Manager (Let's Encrypt certificate download endpoint) access control = restrict or disable - Compensating control
Restrict access to the Nginx Proxy Manager management interface and API (including the certificate download endpoint) to trusted IPs or a management network/VPN via firewall rules or network ACLs.
- Operational
Assume private key material may have been exposed: revoke and reissue any TLS certificates that may have been downloaded and replace the associated private keys. Audit access logs for suspicious downloads or access to the certificate download endpoint.