CVE-2026-93964 NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
Unauthenticated attackers can trigger OpenSSL processing of submitted certificates via the validate route, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93964?
CVE-2026-93964 is a medium-severity missing authorization vulnerability in NginxProxyManager nginx-proxy-manager, published on 20 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. Endpoint only processes and echoes back the certificate the caller submits (no stored data leaked); the real risk is unauthenticated openssl processing of attacker input. The project was informed of the problem early through an issue report but has not responded yet.
Which versions are affected by CVE-2026-93964?
How do I fix CVE-2026-93964?
No fix has been published for CVE-2026-93964 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-93964 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93964 exists.
Sources
Also known as GHSA-75h8-hx74-6qmf.