Unauthenticated Admin Account Creation in nginx-ignition via TOCTOU Race Condition

The nginx-ignition project, prior to version 0.0.0-20260621194639-0586b4e55ab, is vulnerable to an unauthenticated administrative account creation vulnerability (CVE-2026-61628). The vulnerability exists in the POST /api/users/onboarding/finish endpoint, which is explicitly registered as anonymous. The handler performs a check-then-act pattern (TOCTOU) to verify if the system onboarding process has already been completed.

Because the application lacks an atomic guard, database-level unique constraint, or mutex between the state verification (OnboardingCompleted) and the account creation (Save), an unauthenticated remote attacker can exploit a race condition during the installation window. By sending concurrent requests, an attacker can bypass the intent of a single-admin setup and mint multiple administrative accounts, each returning a valid JWT with full ReadWrite permissions. This effectively grants an attacker full control over the nginx-ignition instance, including the ability to manage hosts, routes, and certificates, which can be further abused to facilitate SSRF or arbitrary command execution via the managed nginx server.

Attack Chain

1. Attacker monitors for newly deployed or reset instances of nginx-ignition, identifiable via the onboarding status check endpoint.
2. Attacker prepares a series of concurrent HTTP POST requests to /api/users/onboarding/finish containing a malicious username and password.
3. The target instance receives the concurrent requests before the legitimate administrator completes the initial setup.
4. Each request passes the initial OnboardingCompleted check because the state has not been finalized yet.
5. The server proceeds to Save each request as a separate administrator user with full ReadWrite permissions.
6. The server returns valid administrative JWTs to the attacker for each successful registration.
7. Attacker uses a valid administrative JWT to gain full control over the nginx server configuration and system settings.

Impact

Successful exploitation results in full administrative takeover of the nginx-ignition application. This allows an attacker to manipulate server configurations, redirect traffic, steal credentials, and potentially achieve arbitrary command execution on the underlying host. The TOCTOU race condition also facilitates the creation of multiple persistence accounts from a single concurrent burst, hindering incident response and remediation efforts.

Recommendation

1. Upgrade nginx-ignition to version 0.0.0-20260621194639-0586b4e55ab or later to resolve CVE-2026-61628.
2. Implement atomic database constraints for user creation to prevent concurrent account registration in the onboarding handler.
3. Restrict network access to the onboarding API endpoints until the legitimate administrator completes the setup process.
4. Enable server-side logging for all requests to /api/users/onboarding/finish to monitor for anomalous bursts of POST requests.