CVE-2026-61628

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

• CWE-362

• https://github.com/lucasdillmann/nginx-ignition/commit/0586b4e55ab780676d3553a2592979dfa2fb0183
• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5
• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61612CKAN MCP Server is a tool for querying CKAN open data portal…5.7
• CVE-2026-61613Cursor is a code editor built for programming with AI. Prior…7.7
• CVE-2026-61614SolidInvoice is an open-source invoicing platform. Prior to …5.9
• CVE-2026-61617Wings is the server control plane for the Pterodactyl game-s…7.7
• CVE-2026-6162A vulnerability has been found in PHPGurukul Company Visitor…3.5
• CVE-2026-61625VictoriaMetrics is a scalable solution for monitoring and ma…6.8
• CVE-2026-61629nginx ignition is a user interface for the nginx web server.…7.5
• CVE-2026-6163A vulnerability was identified in code-projects Lost and Fou…7.3
• CVE-2026-61630nginx ignition is a user interface for the nginx web server.…4.2
• CVE-2026-61632PyMdown Extensions is a set of extensions for the Python-Mar…5.3
• CVE-2026-61633NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ clien…2
• CVE-2026-61634The RabbitMQ Java client library allows Java and JVM-based a…0