{"uuid": "ac0646a7-bd72-43a2-9550-cd03f1899b9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61628", "type": "seen", "source": "https://gist.github.com/alon710/c22586b9d9c77f8331c17f01285d9c0d", "content": "# CVE-2026-61628: CVE-2026-61628: Unauthenticated Admin Account Creation via Onboarding Race Condition in Nginx Ignition\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61628\n\n## Summary\nNginx Ignition prior to version 2.41.1 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its unauthenticated onboarding API endpoint. This flaw allows remote, unauthenticated attackers to register an administrative account by sending concurrent HTTP requests during the initial system configuration phase, bypassing the check meant to restrict onboarding to a single initial administrator.\n\n## TL;DR\nUnauthenticated remote attackers can create unauthorized administrative accounts on fresh Nginx Ignition installations by exploiting a race condition in the initial setup API.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-362\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.1\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: Administrative Access\n\n## Affected Systems\n\n- Nginx Ignition\n- **nginx-ignition**: < 2.41.1 (Fixed in: `2.41.1`)\n\n## Mitigation\n\n- Upgrade Nginx Ignition to version 2.41.1 or above to enforce transaction locking.\n- Isolate the Nginx Ignition port and setup paths to prevent unauthorized network access during initial onboarding.\n- Verify the database user table after initialization to confirm that only a single, authorized user account exists.\n\n**Remediation Steps:**\n1. Determine the current version of the Nginx Ignition installation.\n2. If the version is below 2.41.1, apply the latest official update immediately.\n3. Configure web server rules to deny external requests to `/api/users/onboarding/finish` if setup has not been completed.\n4. Query the backend database user table using administrative access to ensure only one user is configured.\n\n## References\n\n- [Nginx Ignition Onboarding Race Condition Advisory](https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5)\n- [Fix Commit 0586b4e55ab](https://github.com/lucasdillmann/nginx-ignition/commit/0586b4e55ab780676d3553a2592979dfa2fb0183)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61628) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T00:01:48.694422Z"}