Skip to content
Threat Feed
Subscribe

Product

Nginx-Ignition (< 0.0.0-20260621194639-0586b4e55ab)

1 brief RSS
high advisory

Unauthenticated Admin Account Creation in nginx-ignition via TOCTOU Race Condition

An unauthenticated time-of-check to time-of-use (TOCTOU) race condition in the nginx-ignition onboarding API allows remote attackers to create administrative accounts on fresh or reset instances.

nginx-ignition webserver authentication-bypass race-condition cve-2026-61628
1r 2t 1c