Skip to content
Threat Feed
Subscribe

Vendor

Lucasdillmann

1 brief RSS
high advisory

Unauthenticated Admin Account Creation in nginx-ignition via TOCTOU Race Condition

An unauthenticated time-of-check to time-of-use (TOCTOU) race condition in the nginx-ignition onboarding API allows remote attackers to create administrative accounts on fresh or reset instances.

nginx-ignition webserver authentication-bypass race-condition cve-2026-61628
1r 2t 1c