Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
nginx-ignition exploit! unauthorized admin account creation. SSL cert creation, virtual host take-over ... all sorts of stuff. exploit: https://github.com/abraxas/CVE-2026-61628 lab write-up: https://abraxaslabs.tech/research/CVE-2026-61628
🔴 nginx-ignition'da CVE-2026-61628 | CVSS 8.1 Yüksek seviyeli güvenlik açığı! nginx-ignition < 2.41.1 sürümlerinde, onboarding aşamasındaki sistemlerde bulunan race condition açığı, kimlik doğrulaması olmadan tam yetkili yönetici hesabı oluşturulmasına izin veriyor. Çözüm: 2.41.1+ sürümüne güncellemek.
@ridvanyagli This is a good one! Exploit: https://github.com/abraxas/CVE-2026-61628 Lab Write-up: https://abraxaslabs.tech/research/CVE-2026-61628