CVE-2026-40519: Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()

Synopsis

This is an OS command injection vulnerability (a form of authenticated remote code execution) in Nginx Proxy Manager versions 2.9.14 through 2.15.1. An attacker who holds the certificates:manage permission can store a malicious payload in the dns_provider_credentials field; when the backend restarts, that payload is interpolated unsanitized into a shell command executed via Node.js child_process.exec(), causing arbitrary OS commands to run on the host. Successful exploitation gives the attacker full read, write, and availability impact on the affected container. A patched-image rebuild at commit a5db5ed156355e3088e7d1ceb0533d4bae922def is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Nginx Proxy Manager web interface over the network to authenticate and submit the malicious payload.

• AuthenticationRequired

  A low-privilege account holding the certificates:manage permission is sufficient; no admin credentials are needed.

• Victim interactionNot required

  No victim interaction is required; the injected command executes automatically when the backend process restarts.

• Attack complexityDetail

  Base exploit logic is straightforward and condition-free, though the CVSS vector notes an attack prerequisite (AT:P) meaning specific backend restart timing or a triggerable restart condition must be in place for the payload to execute.

Blast Radius

• The attacker executes arbitrary OS commands as the process user inside the Nginx Proxy Manager container, enabling full read access to files on the container filesystem including stored credentials and TLS private keys.
• The attacker can write or overwrite files on the container filesystem, allowing persistent backdoor installation or configuration tampering that survives image restarts.
• The attacker can crash or disrupt the proxy service, interrupting routing for all traffic flowing through the affected Nginx Proxy Manager instance.
• Because the injected command runs in the container process context, any secrets or environment variables mounted into that container (API keys, database passwords, cloud provider tokens) are exposed to direct exfiltration.