CVE-2026-61628: CVE-2026-61628: Unauthenticated Admin Account Creation via Onboarding Race Condition in Nginx Ignition

#security #cve #cybersecurity

CVE-2026-61628: Unauthenticated Admin Account Creation via Onboarding Race Condition in Nginx Ignition

Vulnerability ID: CVE-2026-61628
CVSS Score: 8.1
Published: 2026-09-21

Nginx Ignition prior to version 2.41.1 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its unauthenticated onboarding API endpoint. This flaw allows remote, unauthenticated attackers to register an administrative account by sending concurrent HTTP requests during the initial system configuration phase, bypassing the check meant to restrict onboarding to a single initial administrator.

TL;DR

Unauthenticated remote attackers can create unauthorized administrative accounts on fresh Nginx Ignition installations by exploiting a race condition in the initial setup API.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-362
Attack Vector: Network
CVSS v3.1: 8.1
Exploit Status: poc
KEV Status: Not Listed
Impact: Administrative Access

Affected Systems

Nginx Ignition
nginx-ignition: < 2.41.1 (Fixed in: 2.41.1)

Code Analysis

Commit: 0586b4e

Implement transactional dialect-specific database locks to fix race condition in initial user onboarding

@@ -51,7 +52,12 @@ func (h onboardingFinishHandler) handle(ctx *gin.Context) {
- if err = h.commands.Save(ctx.Request.Context(), domainModel, nil); err != nil {
+ if err = h.commands.FinishOnboarding(ctx.Request.Context(), domainModel); err != nil {

Exploit Details

GitHub Security Advisory: GHSA advisory outlining the timing window, database impact, and reproduction methodology.

Mitigation Strategies

Upgrade Nginx Ignition to version 2.41.1 or above to enforce transaction locking.
Isolate the Nginx Ignition port and setup paths to prevent unauthorized network access during initial onboarding.
Verify the database user table after initialization to confirm that only a single, authorized user account exists.

Remediation Steps:

Determine the current version of the Nginx Ignition installation.
If the version is below 2.41.1, apply the latest official update immediately.
Configure web server rules to deny external requests to /api/users/onboarding/finish if setup has not been completed.
Query the backend database user table using administrative access to ensure only one user is configured.

References

Read the full report for CVE-2026-61628 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community