CVE-2026-93964: NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. Endpoint only processes and echoes back the certificate the caller submits (no stored data leaked); the real risk is unauthenticated openssl processing of attacker input. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of nginx-proxy-manager up to version 2.15.1 are affected if the Validate Route endpoint is reachable by a remote attacker. No authentication is required to invoke the affected certificate validation function.
What does an attacker gain by exploiting the endpoint?
The endpoint processes attacker-supplied certificate data with openssl and echoes the submitted certificate back. The available information indicates that it does not expose stored certificate data; the primary concern is unauthenticated processing of untrusted input.
Is exploitation practical?
The issue is remotely exploitable with low attack complexity, requires no privileges or user interaction, and a public exploit is available. The reported impact is limited to confidentiality loss, with no stated integrity or availability impact.
How can I determine whether my deployment may be affected?
Check whether nginx-proxy-manager is version 2.15.1 or earlier and whether remote users can reach the Validate Route that invokes backend/internal/certificate.js internalCertificate.validate. Requests that submit certificates to this endpoint without authentication indicate exposure.
What can be done if an update is not available?
Restrict network access to the Validate Route so untrusted remote users cannot reach it, for example by placing it behind authentication or limiting access to trusted administrative networks. The supplied information does not identify a vendor fix or workaround.