Tag

Cve-2026-61628

1 brief RSS

Unauthenticated Admin Account Creation in nginx-ignition via TOCTOU Race Condition

An unauthenticated time-of-check to time-of-use (TOCTOU) race condition in the nginx-ignition onboarding API allows remote attackers to create administrative accounts on fresh or reset instances.

nginx-ignition webserver authentication-bypass race-condition cve-2026-61628

1r 2t 1c 46m ago