EUVD-2026-88568

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

PT-2026-102397

Name of the Vulnerable Software and Affected Versions Nginx Proxy Manager versions prior to 2.16.1 Description Non-administrator users with manage permissions can inject arbitrary nginx directives because the software fails to restrict the advanced config field to administrators. This allows...

CVE-2026-11311 NGINX Gateway Fabric vulnerability

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the...