CVE-2026-61628: Unauthenticated Admin Account Creation via Onboarding Race Condition in Nginx Ignition

Vulnerability ID: CVE-2026-61628
CVSS Score: 8.1
Published: 2026-09-21

Nginx Ignition prior to version 2.41.1 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its unauthenticated onboarding API endpoint. This flaw allows remote, unauthenticated attackers to register an administrative account by sending concurrent HTTP requests during the initial system configuration phase, bypassing the check meant to restrict onboarding to a single initial administrator.

TL;DR

Unauthenticated remote attackers can create unauthorized administrative accounts on fresh Nginx Ignition installations by exploiting a race condition in the initial setup API.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-362
• Attack Vector: Network
• CVSS v3.1: 8.1
• Exploit Status: poc
• KEV Status: Not Listed
• Impact: Administrative Access

Affected Systems

• Nginx Ignition
• nginx-ignition: < 2.41.1 (Fixed in: 2.41.1)

Code Analysis

Commit: 0586b4e

Implement transactional dialect-specific database locks to fix race condition in initial user onboarding

@@ -51,7 +52,12 @@ func (h onboardingFinishHandler) handle(ctx *gin.Context) {
- if err = h.commands.Save(ctx.Request.Context(), domainModel, nil); err != nil {
+ if err = h.commands.FinishOnboarding(ctx.Request.Context(), domainModel); err != nil {

Exploit Details

• GitHub Security Advisory: GHSA advisory outlining the timing window, database impact, and reproduction methodology.

Mitigation Strategies

• Upgrade Nginx Ignition to version 2.41.1 or above to enforce transaction locking.
• Isolate the Nginx Ignition port and setup paths to prevent unauthorized network access during initial onboarding.
• Verify the database user table after initialization to confirm that only a single, authorized user account exists.

Remediation Steps:

1. Determine the current version of the Nginx Ignition installation.
2. If the version is below 2.41.1, apply the latest official update immediately.
3. Configure web server rules to deny external requests to /api/users/onboarding/finish if setup has not been completed.
4. Query the backend database user table using administrative access to ensure only one user is configured.

References

• Nginx Ignition Onboarding Race Condition Advisory
• Fix Commit 0586b4e55ab

Read the full report for CVE-2026-61628 on our website for more details including interactive diagrams and full exploit analysis.