Tag
#CVE-2026-61628
CVE-2026-61628: Unauthenticated Admin Account Creation in nginx ignition
A critical vulnerability in nginx ignition (CVE-2026-61628, CVSS 8.1) allows unauthenticated remote attackers to create admin accounts with full ReadWrite permissions. This is possible due to a TOCTOU (check-then-act) vulnerability in the `POST /api/users/onboarding/finish` endpoint prior to version 2.41.1. Affected users must update to version 2.41.1 or later to mitigate this risk.
Unauthenticated Admin Account Creation in nginx ignition via Onboarding Race Condition
A critical vulnerability (CVE-2026-61628) in nginx ignition allows unauthenticated attackers to create admin accounts with full ReadWrite permissions. The vulnerability stems from a TOCTOU (time-of-check to time-of-use) race condition in the onboarding process. Attackers can exploit this during the fresh deployment or if the onboarding state is reset. Immediate patching or mitigation is crucial to prevent unauthorized admin access.