Read the docs
TI-2026-44137 Aliases CVE-2026-61628GHSA-pxcx-fv34-x9p5

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Priority HIGH 70CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed nginx-ignition (lucasdillmann): 2.41.1github.com/lucasdillmann/nginx-ignition (Go): 0.0.0-20260621194639-0586b4e55ab

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lucasdillmannnginx-ignitionbefore 2.41.12.41.1Patch availableCNA
—github.com/lucasdillmann/nginx-ignition (Go)before 0.0.0-20260621194639-0586b4e55ab0.0.0-20260621194639-0586b4e55abPatch availableGHSA-pxcx-fv34-x9p5
  • nginx-ignition Vendorlucasdillmann Affected before 2.41.1 Fixed in 2.41.1 Patch available CNA
  • github.com/lucasdillmann/nginx-ignition (Go) Vendor— Affected before 0.0.0-20260621194639-0586b4e55ab Fixed in 0.0.0-20260621194639-0586b4e55ab Patch available GHSA-pxcx-fv34-x9p5

Remediation

  • Fix · CNA nginx-ignition (lucasdillmann) Fixed in 2.41.1
  • Fix · GHSA-pxcx-fv34-x9p5 github.com/lucasdillmann/nginx-ignition (Go) Fixed in 0.0.0-20260621194639-0586b4e55ab Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61628
  2. 2026-10-03 Alias added: GHSA-pxcx-fv34-x9p5
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 5

  • TI-2026-44138 Resource allocation without limits in lucasdillmann nginx-ignition CVSS 3.1HIGH 7.5
  • TI-2026-44139 nginx ignition has TOTP Reuse During Validity Window CVSS 3.1MEDIUM 4.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences