CVE-2026-61628
Received Received - Intake

nginx Ignition Pre-Onboarding Admin Account Creation via Race Condition

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-61628
EUVD
EUVD-2026-83947

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nginx ignition to 2.41.1 (exc)
lucasdillmann nginx_ignition to 2.41.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in nginx ignition versions before 2.41.1. The POST /api/users/onboarding/finish endpoint is accessible without authentication and uses a check-then-act pattern. An attacker can send concurrent requests during the pre-onboarding state to create multiple admin accounts with full permissions.

Detection Guidance

To detect this vulnerability, check if your nginx-ignition instance is running a version prior to 2.41.1. You can verify the version by inspecting the running container or application logs. If you have access to the system, run: docker ps | grep nginx-ignition or curl -s http://localhost/api/version. Additionally, monitor for unexpected admin account creations or unusual activity during the onboarding phase.

Impact Analysis

An unauthenticated attacker could gain full administrative control over the nginx ignition instance and the managed nginx server. This includes creating multiple admin accounts, accessing sensitive data, and modifying configurations without authorization.

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems handling sensitive data, violating compliance requirements for data protection and access control in standards like GDPR and HIPAA.

Mitigation Strategies

Immediately upgrade nginx-ignition to version 2.41.1 or later. If upgrading is not possible, restrict access to the POST /api/users/onboarding/finish endpoint by implementing network-level controls or authentication requirements. Ensure no unauthorized admin accounts exist and revoke any suspicious JWT tokens issued during the vulnerable period.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart