CVE-2026-61628: nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nginx ignitionto a version that resolves this vulnerability.Fixed in 2.41.1 - Configuration
Ensure the endpoint POST /api/users/onboarding/finish is not registered as anonymous (unauthenticated); allow only authenticated requests.
nginx ignition POST /api/users/onboarding/finish access/registration = authenticated only (remove anonymous/unauthenticated registration)
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Instances running a version earlier than 2.41.1 are exposed only while they remain in the pre-onboarding state and are reachable by a remote attacker. The vulnerable endpoint is anonymous, so no existing account is required.
What does an attacker need to do to gain administrator access?
An attacker must send requests to POST /api/users/onboarding/finish while onboarding has not yet been completed. Exploitation relies on racing the endpoint's onboarding-state check and user-creation write; concurrent requests may create multiple full ReadWrite administrator accounts.
Does completing onboarding remove the described exposure?
The described attack requires the instance to be in its pre-onboarding state. Completing onboarding prevents this specific pre-onboarding attack condition, but upgrading to version 2.41.1 is the available fix.
What can be done if an immediate upgrade is not possible?
Ensure onboarding is completed and prevent untrusted remote access to the instance while it is in the pre-onboarding state. Because the endpoint is unauthenticated, network reachability during onboarding is the key exposure condition.