starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 09:25:55 +03:00

[GH-ISSUE #4600] Frontend is storing password in clear text #2937

New issue

Open

opened 2026-02-26 07:37:15 +03:00 by kerem · 2 comments

kerem commented

2026-02-26 07:37:15 +03:00

Owner

Originally created by @eriosgamer on GitHub (Jun 29, 2025).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4600

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug
While exploring the SQLite database, I found that passwords are stored in plain text in the"access_list_auth" table.

Nginx Proxy Manager Version
jc21/nginx-proxy-manager:latest

To Reproduce
Steps to reproduce the behavior:
1- Make a fresh install
2- Set the user and password
3- Create a new Access List

Expected behavior
Passwords or authorization details should be securely stored (e.g., hashed) in the database.

Screenshots

Operating System
CachyOS (Arch Linux) and Debian 12

Additional context
Docker Version: 28.3.0, build 38b7060a21
Docker-Compose Version: version 2.37.3

The screenshot is from a Python script i wrote that displays the contents of database.sqlite.

Originally created by @eriosgamer on GitHub (Jun 29, 2025). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4600 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug** While exploring the SQLite database, I found that passwords are stored in plain text in the"access_list_auth" table. **Nginx Proxy Manager Version** jc21/nginx-proxy-manager:latest **To Reproduce** Steps to reproduce the behavior: 1- Make a fresh install 2- Set the user and password 3- Create a new Access List **Expected behavior** Passwords or authorization details should be securely stored (e.g., hashed) in the database. **Screenshots** ![Image](https://github.com/user-attachments/assets/34dbcbcb-c883-4b6a-90d6-a2ede45143b1) **Operating System** CachyOS (Arch Linux) and Debian 12 **Additional context** Docker Version: 28.3.0, build 38b7060a21 Docker-Compose Version: version 2.37.3 The screenshot is from a Python script i wrote that displays the contents of database.sqlite.

kerem added the

stale

bug

labels

2026-02-26 07:37:15 +03:00

kerem commented

2026-02-26 07:37:15 +03:00

Author

Owner

@rezzorix commented on GitHub (Jul 1, 2025):

Not a bug.

The access_list_auth table stores plaintext credentials so Nginx Proxy Manager can generate authentication configs for Nginx and allow users to edit those credentials through the UI. Nginx reads these files for HTTP Basic Auth (Nginx auth_basic module) but does not create them itself.

This isn’t a security risk unless someone already has access to your server files. User login passwords for NPM itself are stored hashed.

@rezzorix commented on GitHub (Jul 1, 2025): **Not a bug.** The `access_list_auth` table stores plaintext credentials so Nginx Proxy Manager can generate authentication configs for Nginx and allow users to edit those credentials through the UI. Nginx reads these files for HTTP Basic Auth ([Nginx auth_basic module](https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html)) but does not create them itself. This isn’t a security risk unless someone already has access to your server files. User login passwords for NPM itself are stored hashed.

kerem commented

2026-02-26 07:37:15 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 5, 2026):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Jan 5, 2026): Issue is now considered stale. If you want to keep it open, please comment :+1:

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#2937

No description provided.

Rows
Columns