CVE-2026-61628: Unauthenticated Admin Account Creation in nginx ignition

Executive Summary

A critical vulnerability in nginx ignition, a user interface for the nginx web server, has been identified (CVE-2026-61628). This vulnerability, with a CVSS score of 8.1, allows unauthenticated remote attackers to create administrator accounts with full ReadWrite permissions. The issue arises from a check-then-act (TOCTOU) pattern in the `POST /api/users/onboarding/finish` endpoint, which is registered as anonymous (unauthenticated). This vulnerability affects versions prior to 2.41.1 of nginx ignition.

Technical Analysis

The vulnerability class of CVE-2026-61628 is a TOCTOU (check-then-act) vulnerability. The attack vector involves an unauthenticated remote attacker who can reach an instance of nginx ignition in its pre-onboarding state. The specific endpoint vulnerable is `POST /api/users/onboarding/finish`. The root cause of this vulnerability is the lack of atomic guard between the "onboarding already completed?" check and the user-creation write operation. This allows an attacker to create an administrator account by exploiting the race condition.

How It Gets Exploited

An unauthenticated remote attacker who can reach an instance of nginx ignition in its pre-onboarding state can exploit this vulnerability. The attacker sends a `POST` request to the `/api/users/onboarding/finish` endpoint. If the onboarding process has not been completed, the handler checks if the onboarding is finished and, finding it not completed, proceeds to create a new user with full ReadWrite admin permissions. Due to the TOCTOU nature of the vulnerability, concurrent requests can create multiple admin accounts in a single race condition. This can lead to an attacker creating an administrator account for themselves.

Impact Assessment

The impact of CVE-2026-61628 is significant. Successful exploitation allows an unauthenticated attacker to create an administrator account with full ReadWrite permissions. This could lead to a complete compromise of the nginx ignition instance, allowing the attacker to modify configurations, view sensitive information, and potentially pivot to other parts of the network. The CVSS score of 8.1 reflects the high severity of this vulnerability, with high impacts on confidentiality, integrity, and availability. The affected product is nginx ignition, specifically versions prior to 2.41.1.

Recommended Actions

To mitigate this vulnerability, users of nginx ignition must update to version 2.41.1 or later. This version patches the TOCTOU vulnerability in the `POST /api/users/onboarding/finish` endpoint, ensuring that user creation is properly secured and preventing unauthenticated admin account creation. Additionally, users should monitor their instances for any suspicious activity, particularly the creation of unexpected admin accounts.

Sources

- National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-61628 - GitHub Security Advisory: https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5