Unauthenticated User Creation Vulnerability in nginx Ignition
CVE-2026-61628

8.1HIGH

Key Information:

Vendor

Lucasdillmann

Status
Nginx-ignition
Vendor
CVE Published:
21 September 2026

What is CVE-2026-61628?

The nginx Ignition user interface for the nginx web server contains a vulnerability that exposes an endpoint allowing remote unauthenticated attackers to create user accounts with full admin privileges. Specifically, the issue arises from the improper handling of race conditions in the onboarding process. The POST /api/users/onboarding/finish endpoint can be exploited to create multiple admin accounts without proper authentication due to the absence of atomic guards. This vulnerability has been addressed in version 2.41.1, which mitigates the risk by enforcing stricter access controls.

Affected Version(s)

nginx-ignition < 2.41.1

References

https://github.com/lucasdillmann/nginx-ignition/security/...
x_refsource_CONFIRM
https://github.com/lucasdillmann/nginx-ignition/commit/05...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.