CVE-2026-40519: Nginx Proxy Manager Remote Code Execution via Command Injection

Technical summary

CVE-2026-40519 is an authenticated remote code execution vulnerability stemming from OS command injection in the setupCertbotPlugins() function located in backend/setup.js. The vulnerability arises because user-supplied data from the dns_provider_credentials field is interpolated directly into a shell command without sanitization or escaping before being executed via child_process.exec(). An attacker who possesses the certificates:manage permission can craft a malicious payload in this field; upon backend restart, the payload executes with the privileges of the Nginx Proxy Manager process. The affected version range spans 2.9.14 through 2.15.1, with remediation available in commit a5db5ed.

Business impact

Successful exploitation grants an authenticated insider or compromised administrator account the ability to execute arbitrary code on the Nginx Proxy Manager host. This can lead to full server compromise, data exfiltration, lateral movement to other systems on the network, deployment of persistent backdoors, or disruption of proxy services. Organizations relying on Nginx Proxy Manager for SSL/TLS termination and request routing face potential service unavailability and breach of encrypted traffic intended for inspection or logging.

Affected systems

Nginx Proxy Manager versions 2.9.14 through 2.15.1 are vulnerable. Users must verify their installed version and apply the patch from commit a5db5ed or upgrade to a version incorporating that commit. The vulnerability requires that an attacker either be a legitimate user with certificates:manage permission or that such credentials have been compromised.

Exploitability

Exploitation requires prior authentication and the certificates:manage permission, which significantly restricts the attack surface. However, once those prerequisites are met, the attack is straightforward: inject a payload into the dns_provider_credentials field and restart the backend service. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that network access is possible but attack complexity is high, authentication is mandatory, and no user interaction is needed for execution. In environments where certificate administrators are trusted or where credentials are poorly managed, this becomes a meaningful risk.

Remediation

Apply the patch available in commit a5db5ed to Nginx Proxy Manager. Users should identify all instances running versions 2.9.14 through 2.15.1 and prioritize updates. In parallel, audit which users and service accounts hold the certificates:manage permission and apply the principle of least privilege to restrict this role. Review logs for any suspicious certificate management activity or backend restart patterns that might indicate prior exploitation.

Patch guidance

Verify the specific patch version or commit hash a5db5ed against the official Nginx Proxy Manager repository and apply it to your deployment. Follow the project's standard update procedures, which typically include backing up configuration, testing in a non-production environment, and scheduling the update during a maintenance window because backend restart is required for the patch to take effect and for any injected payloads to be neutralized.

Detection guidance

Monitor for dns_provider_credentials entries containing shell metacharacters or command sequences (backticks, $(), &&, |, ;, etc.) in configuration or audit logs. Log and alert on backend restart events, particularly those initiated shortly after certificate credential modifications. Network intrusion detection should look for unusual process execution spawned by the Nginx Proxy Manager process, especially commands indicative of reconnaissance, privilege escalation, or lateral movement. Review audit trails for certificate:manage permission assignments and any access by unexpected principals.

Why prioritize this

While the attack requires prior authentication, the impact is severe—unauthenticated remote code execution on the proxy host—and the attack vector is simple once credentials are obtained. The HIGH CVSS score (7.5) and the prevalence of Nginx Proxy Manager in production SSL/TLS infrastructure make this a priority for organizations using affected versions. Internal credential compromise or insider threats pose a non-trivial risk in many environments.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) balances the requirement for authentication and elevated permissions (PR:L, AC:H) against the severe confidentiality, integrity, and availability impact (C:H/I:H/A:H). The high complexity factor reflects that the attacker must know or guess the structure of the vulnerability and ensure backend restart occurs, but these are not substantial barriers in typical operational environments. The HIGH severity reflects realistic exploitability if an attacker already possesses or can compromise a certificate manager account.

Frequently asked questions