Security patch: v1.6.486 — please update. Reverse-proxy admin panel was claimable on a fresh install
Posted by tomspark
Security moderation correction — 5 September 2026: The affected-user and existing-account wording below has been corrected. An update does not rotate a password copied from a public support recipe. Please update: sudo sparkbox upgrade SparkBox installs Nginx Proxy Manager — the piece that routes web traffic to your apps and handles SSL certificates — and publishes its admin panel on port 81 so you can reach it from your laptop rather than needing an SSH tunnel. On a box where nobody had ever opened that panel, it had no account yet. Nginx Proxy Manager lets the first visitor create the admin account with no password required — that's how its first-run setup works. Because we published the port to the whole network, that first visitor didn't have to be you. On a machine with a public IP (a VPS install), it didn't have to be anyone on your network either. What that account controls is the component that terminates HTTPS and decides where your traffic goes, which is why this is worth doing today rather than this weekend. Were you affected? - If you had already set a unique Nginx Proxy Manager password, the unclaimed-account issue no longer applies once that account exists. That does not establish whether the panel was exposed before the account was created. Existing accounts are left unchanged by this update. A password copied from a public support recipe is not a unique password; it must be changed in Nginx Proxy Manager. - If you never opened it, the panel was sitting there unclaimed. Whether anyone found it is a different question from whether they could have. What the update does: SparkBox now creates that admin account itself, with a strong random password, during startup — before the panel can accept anything. You'll find the login in Settings → Service Passwords under "Nginx Proxy Manager admin". Existing boxes get the same treatment when they update only if Nginx Proxy Manager has no existing users. The update does not rotate passwords on existing accounts. If you want to check your own box after updating: open Nginx Proxy Manager on port 81 using your current Nginx Proxy Manager login, and review the Users list and Proxy Hosts. If you find changes you do not recognise, preserve the details and contact private support before changing or deleting them. SparkBox’s saved password may differ if you changed it inside Nginx Proxy Manager. One more thing worth owning: the dashboard had been telling you the opposite of the truth about this. The tile said port 81 was restricted to the machine itself and that a network connection "would always refuse". That stopped being true in v1.6.36 and the text was never updated — so the one screen that would have made someone look into this instead said there was nothing to look at. That's corrected too. Found during our own audit of the remote-access components, not by anyone being hit. But the honest summary is that it was open, on purpose, for longer than it should have been.