abraxas/cve-2026-61628Proof-of-concept and disclosure pack for CVE-2026-61628, an unauthenticated TOCTOU privilege escalation in nginx-ignition 2.41.0 that allows admin account creation.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-61628
nginx-ignition 2.41.0 — lucasdillmann
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the onboarding already completed check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.
| CVE | CVE-2026-61628 · CVE.org |
| CWE | CWE-362 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Product | nginx-ignition |
| Affected | all versions through 2.41.0 (inclusive) |
| Patched | 2.41.1 and later |
| Auth | unauthenticated (see source map) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only · vendor/client disclosure pack, not a scanner |
api/user/onboarding_finish_handler.go check-then-act. Route AllowAnonymous in api/user/routes.go. Patch 2.41.1 FinishOnboarding.
POST/api/users/onboarding/finishGET /api/users/onboarding/status finished=falseconcurrent POST /api/users/onboarding/finish JSON name/username/passwordOnboardingCompleted check then Save without lock200 JSON token JWT; GET /api/users/current Users=READ_WRITEUnauthenticated 200 with JWT; /api/users/current Users=READ_WRITE. Race: n200>=2 distinct admin usernames.
Do this first: Update nginx-ignition to 2.41.1 or newer.
Verify after upgrade
CVE-2026-61628-Abraxas-Labs.py against the patched build: the mapped witness must not appear.If you cannot update immediately
Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.
python3 CVE-2026-61628-Abraxas-Labs.py
Success is the witness above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.
cd lab
docker compose up --force-recreate
Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.
github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5
github.com/lucasdillmann/nginx-ignition/commit/0586b4e55ab780676d3553a2592979dfa2fb0183
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-61628
CWE: CWE-362
CVSS: High 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
## NVD description
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the onboarding already completed check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.
## Product
nginx-ignition 2.41.0 (fixed in 2.41.1). Not RCE.
This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.
This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.