VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 15, 2026

CVE-2026-50892

CVE-2026-50892

Description

Nginx Proxy Manager 2.14.0's certificate download endpoint exposes TLS private key material to users with certificate read access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Nginx Proxy Manager 2.14.0's certificate download endpoint exposes TLS private key material to users with certificate read access.

Vulnerability

Nginx Proxy Manager version 2.14.0 contains an incorrect access control vulnerability in the certificate download endpoint GET /api/nginx/certificates/:certificate_id/download. The handler in backend/internal/certificate.js packages files from the live certificate directory into a ZIP archive. While access requires the certificates:get permission for the target certificate, the response includes the private key file (privkey.pem) alongside public certificate and chain material, violating the expected read-only certificate visibility boundary [1].

Exploitation

An authenticated attacker with certificate read access (the certificates:get capability for a specific certificate) can exploit this by sending a crafted GET request to /api/nginx/certificates/{certificate_id}/download for a visible certificate. The server returns a ZIP archive containing the private key material. No additional privileges or user interaction beyond authentication and the permission to read the certificate are required [1].

Impact

Successful exploitation results in disclosure of the selected TLS certificate's private key to an attacker who should only have certificate read visibility. With possession of the private key, the attacker can impersonate the TLS endpoint, decrypt intercepted traffic, and perform man-in-the-middle attacks. Affected certificates must be rotated to restore trust [1].

Mitigation

As of the publication date (2026-06-15), no official patch has been released for Nginx Proxy Manager 2.14.0. The vendor has not yet disclosed a fixed version or workaround in the available references [1]. Users should restrict certificate read access to only trusted accounts and monitor for updates from the project.

References
  1. Reference for CVE-2026-50892

AI Insight generated on Jun 15, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The download endpoint includes private key files in the ZIP archive instead of limiting the response to public certificate or chain material."

Attack vector

An authenticated attacker with certificate read access (e.g., the `certificates:get` capability) sends a crafted GET request to `/api/nginx/certificates/{certificate_id}/download` for a certificate they can view. The server returns a ZIP archive that includes the private key file (`privkey.pem`) from the certificate directory. The attacker can then unzip the archive and extract the TLS private key material, enabling impersonation of the TLS endpoint.

Affected code

The vulnerability resides in the download handler at `backend/internal/certificate.js::download()` (route `GET /api/nginx/certificates/:certificate_id/download`). The endpoint packages files from the live certificate directory into a ZIP archive but fails to exclude private key files such as `privkey.pem`, returning them alongside public certificate material.

What the fix does

The advisory does not include a published patch. The recommended remediation is to modify the `download()` handler in `backend/internal/certificate.js` so that the generated ZIP archive contains only public certificate and chain files, explicitly excluding private key material such as `privkey.pem`. Without this change, any user with read-level certificate access can obtain the private key, violating the principle of least privilege.

Preconditions

  • authAttacker must be authenticated to Nginx Proxy Manager 2.14.0
  • authAttacker must have certificate read access (e.g., the certificates:get permission) for the target certificate
  • inputAttacker must send a GET request to /api/nginx/certificates/{certificate_id}/download

Reproduction

Log in to Nginx Proxy Manager 2.14.0 as a user with certificate read access, such as the `certificates:get` permission for a certificate. Send `GET /api/nginx/certificates/{certificate_id}/download` for a certificate visible to that user. Save and unzip the returned archive. Observe private key material such as `privkey.pem` included alongside the certificate files. Compare the result with the expected read-only certificate visibility boundary and confirm that private key material is included in the downloaded package.

Generated on Jun 15, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.