{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-61628/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:lucasdillmann:nginx-ignition:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-61628"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nginx-ignition (\u003c 0.0.0-20260621194639-0586b4e55ab)"],"_cs_severities":["high"],"_cs_tags":["webserver","authentication-bypass","race-condition","cve-2026-61628"],"_cs_type":"advisory","_cs_vendors":["lucasdillmann"],"content_html":"\u003cp\u003eThe nginx-ignition project, prior to version 0.0.0-20260621194639-0586b4e55ab, is vulnerable to an unauthenticated administrative account creation vulnerability (CVE-2026-61628). The vulnerability exists in the \u003ccode\u003ePOST /api/users/onboarding/finish\u003c/code\u003e endpoint, which is explicitly registered as anonymous. The handler performs a check-then-act pattern (TOCTOU) to verify if the system onboarding process has already been completed.\u003c/p\u003e\n\u003cp\u003eBecause the application lacks an atomic guard, database-level unique constraint, or mutex between the state verification (\u003ccode\u003eOnboardingCompleted\u003c/code\u003e) and the account creation (\u003ccode\u003eSave\u003c/code\u003e), an unauthenticated remote attacker can exploit a race condition during the installation window. By sending concurrent requests, an attacker can bypass the intent of a single-admin setup and mint multiple administrative accounts, each returning a valid JWT with full ReadWrite permissions. This effectively grants an attacker full control over the nginx-ignition instance, including the ability to manage hosts, routes, and certificates, which can be further abused to facilitate SSRF or arbitrary command execution via the managed nginx server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker monitors for newly deployed or reset instances of nginx-ignition, identifiable via the onboarding status check endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker prepares a series of concurrent HTTP POST requests to \u003ccode\u003e/api/users/onboarding/finish\u003c/code\u003e containing a malicious username and password.\u003c/li\u003e\n\u003cli\u003eThe target instance receives the concurrent requests before the legitimate administrator completes the initial setup.\u003c/li\u003e\n\u003cli\u003eEach request passes the initial \u003ccode\u003eOnboardingCompleted\u003c/code\u003e check because the state has not been finalized yet.\u003c/li\u003e\n\u003cli\u003eThe server proceeds to \u003ccode\u003eSave\u003c/code\u003e each request as a separate administrator user with full ReadWrite permissions.\u003c/li\u003e\n\u003cli\u003eThe server returns valid administrative JWTs to the attacker for each successful registration.\u003c/li\u003e\n\u003cli\u003eAttacker uses a valid administrative JWT to gain full control over the nginx server configuration and system settings.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative takeover of the nginx-ignition application. This allows an attacker to manipulate server configurations, redirect traffic, steal credentials, and potentially achieve arbitrary command execution on the underlying host. The TOCTOU race condition also facilitates the creation of multiple persistence accounts from a single concurrent burst, hindering incident response and remediation efforts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade nginx-ignition to version 0.0.0-20260621194639-0586b4e55ab or later to resolve CVE-2026-61628.\u003c/li\u003e\n\u003cli\u003eImplement atomic database constraints for user creation to prevent concurrent account registration in the onboarding handler.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the onboarding API endpoints until the legitimate administrator completes the setup process.\u003c/li\u003e\n\u003cli\u003eEnable server-side logging for all requests to \u003ccode\u003e/api/users/onboarding/finish\u003c/code\u003e to monitor for anomalous bursts of POST requests.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-22T01:52:12Z","date_published":"2026-09-22T01:52:12Z","id":"https://feed.craftedsignal.io/briefs/2026-09-nginx-ignition-race-condition/","summary":"An unauthenticated time-of-check to time-of-use (TOCTOU) race condition in the nginx-ignition onboarding API allows remote attackers to create administrative accounts on fresh or reset instances.","title":"Unauthenticated Admin Account Creation in nginx-ignition via TOCTOU Race Condition","url":"https://feed.craftedsignal.io/briefs/2026-09-nginx-ignition-race-condition/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-61628","version":"https://jsonfeed.org/version/1.1"}