CVE-2026-61628
HighCVSS 8.1Summary
In nginx ignition prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race.
Risk Assessment
The vulnerability allows an unauthenticated attacker to create an administrator account and fully take over the instance. This poses a critical system takeover risk.
Recommendation
Upgrade nginx-ignition to version 2.41.1 or later. Until patched, do not expose instances in the pre-onboarding state to untrusted networks.
Other vulnerabilities in nginx ignition
See all- CVE-2026-61630Medium
nginx ignition (the UI for the nginx web server) in versions 2.33.0 through 2.35.0 has a vulnerability that allows a user with OTP 2FA enabled to reuse their TOTP during the standard 30-second validity window. Version 2.35.1 patches this issue.
- CVE-2026-61629High
In nginx ignition versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags; the CVE-2022-32149 guard caps the number of '-' characters at 1000 but does not cap '_' characters even though the parser's internal scanner aliases '_' to '-' before parsing. A single unauthenticated GET request with an Accept-Language header built out of '_' separators burns about 2.4 seconds of server CPU.
Original NVD description (English source)
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.