Is CVE-2026-102334 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102334 being exploited in the wild.

How severe is CVE-2026-102334?

High severity, with a CVSS score of 7.4, published 28 September 2026.

Which products and versions are affected?

Nginx Proxy Manager through 2.16.0.

Is there a fix for CVE-2026-102334?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-102334 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102334?

Check whether you run Nginx Proxy Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102334: Nginx Proxy Manager missing rate-limiting on authentication

CVE-2026-102334 · Severity: high · CVSS 7.4 · Published 2026-09-28

Nginx Proxy Manager, a Docker container for managing reverse proxy configurations with SSL termination, lacks rate-limiting protections on its login endpoints. An attacker can make unlimited password guesses and brute-force TOTP codes to gain full administrative access to the system, compromising all proxied services and SSL certificates managed through it.

Technologies: Nginx Proxy Manager. Vendors: Nginx Proxy Manager.

Quick answers

Is CVE-2026-102334 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102334 being exploited in the wild.
How severe is CVE-2026-102334?: High severity, with a CVSS score of 7.4, published 28 September 2026.
Which products and versions are affected?: Nginx Proxy Manager through 2.16.0.
Is there a fix for CVE-2026-102334?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102334 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102334?: Check whether you run Nginx Proxy Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The application lacks rate-limiting on POST /api/tokens (password authentication) and POST /api/tokens/2fa (TOTP verification) endpoints, allowing unauthenticated attackers to perform unlimited brute-force attacks. An attacker can sequentially guess credentials and 2FA codes to obtain a valid session token and full admin privileges. No authentication or network boundary is required; attacks succeed remotely over the network against any user account.

Affected products

Nginx Proxy Manager Nginx Proxy Manager through 2.16.0

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.