CVE-2026-61628: nginx ignition Privilege Escalation Flaw

CVE-2026-61628 Overview

CVE-2026-61628 is a race condition vulnerability in nginx ignition, a user interface for the nginx web server. Versions prior to 2.41.1 expose the POST /api/users/onboarding/finish endpoint as anonymous, allowing unauthenticated user creation with full ReadWrite administrator permissions. The handler uses a check-then-act pattern between the onboarding-completion check and the user-creation write, with no atomic guard. A remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account. Concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

Critical Impact
Remote unauthenticated attackers can create administrator accounts on pre-onboarded nginx ignition instances, resulting in full compromise of the management interface and any nginx configurations under its control.

Affected Products

nginx ignition versions prior to 2.41.1
Deployments exposing the onboarding endpoint to untrusted networks
Instances that have not yet completed initial onboarding

Discovery Timeline

2026-09-21 - CVE-2026-61628 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61628

Vulnerability Analysis

The vulnerability [CWE-362] is a Time-of-Check Time-of-Use (TOCTOU) race condition in the onboarding workflow. The POST /api/users/onboarding/finish route is registered without authentication so a first-time operator can create the initial administrator. The handler first checks whether onboarding has already completed, then writes a new administrator record if it has not. Because no atomic guard, lock, or unique constraint enforces single execution, the two operations are not serialized.

An attacker who reaches the instance before legitimate onboarding runs can call the endpoint directly and provision an administrator. Concurrent requests exploit the window between check and act, allowing multiple administrator accounts to be created in a single race. The resulting account holds ReadWrite admin permissions across the nginx ignition management surface.

Root Cause

The root cause is a non-atomic check-then-act sequence around a state flag. The handler treats onboarding status as a soft precondition rather than enforcing single execution through a database transaction, unique constraint, or mutex. Combined with an anonymous route registration, this design allows both single-request abuse in the pre-onboarding window and multi-request race exploitation.

Attack Vector

Exploitation requires network reachability to the nginx ignition management interface. The attacker sends one or more concurrent unauthenticated POST requests to /api/users/onboarding/finish supplying attacker-chosen credentials. If the instance has not completed onboarding, or if concurrent requests win the race, the server persists a new administrator account. The attacker then authenticates and takes full control of nginx ignition and any managed nginx configuration.

text

// Patch reference from the fix commit
-FROM nginx:1.31.1-alpine AS builder
+FROM nginx:1.31.2-alpine AS builder

 RUN apk add --no-cache \
       gcc \
// Source: https://github.com/lucasdillmann/nginx-ignition/commit/0586b4e55ab780676d3553a2592979dfa2fb0183

Refer to the GitHub Security Advisory GHSA-pxcx-fv34-x9p5 for the full advisory text.

Detection Methods for CVE-2026-61628

Indicators of Compromise

Unexpected administrator accounts present in the nginx ignition user store, especially with recent creation timestamps.
HTTP access logs showing POST /api/users/onboarding/finish requests from external or unexpected source addresses.
Multiple POST /api/users/onboarding/finish requests arriving within a narrow time window, indicating race exploitation.
Successful authentication events immediately following an onboarding-finish request from the same source.

Detection Strategies

Alert on any 2xx response to /api/users/onboarding/finish after the initial onboarding is expected to have completed.
Baseline the legitimate onboarding event and flag any subsequent invocations of the endpoint as anomalous.
Correlate reverse-proxy or web application firewall logs with nginx ignition audit logs to identify admin creations lacking a corresponding legitimate onboarding session.

Monitoring Recommendations

Ingest nginx ignition access and audit logs into a centralized log platform and retain them for incident response.
Monitor privilege changes and user creation events on the management interface and route them to security operations.
Track exposure of the management interface with external attack surface scans to detect unintended internet-facing instances.

How to Mitigate CVE-2026-61628

Immediate Actions Required

Upgrade nginx ignition to version 2.41.1 or later, which patches the TOCTOU flaw and closes anonymous access to the onboarding-finish route.
Audit the user database for unrecognized administrator accounts and remove any that were not provisioned by an authorized operator.
Rotate credentials, API tokens, and session secrets for all administrator accounts if unauthorized creation is suspected.
Restrict network reachability to the management interface until the upgrade is verified.

Patch Information

Version 2.41.1 remediates the vulnerability. Review the fix in the upstream repository at the GitHub Commit Update and follow the guidance in the GitHub Security Advisory GHSA-pxcx-fv34-x9p5.

Workarounds

Place the nginx ignition management interface behind a VPN or authenticated reverse proxy so unauthenticated requests cannot reach /api/users/onboarding/finish.
Complete onboarding immediately after deployment on an isolated network to shrink the exploitation window.
Block the /api/users/onboarding/finish route at the reverse proxy after initial onboarding is complete.

bash

# Example nginx reverse-proxy rule blocking the onboarding endpoint post-setup
location = /api/users/onboarding/finish {
    return 403;
}