VulnSocial

CVE-2026-61628Patch

MEDIUMCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-362

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 3 mentions (2026-09-22); latest day: 1
  • 6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d
01223Mentions · 2026-09-22: 3Mentions · 2026-09-23: 1Mentions · 2026-10-04: 1Mentions · 2026-10-12: 1PoC Mentioned / Linked · 2026-09-22: 1Exploit Tool / Code · 2026-09-22: 2Patch / Workaround · 2026-09-22: 1Patch / Workaround · 2026-10-04: 1Patch / Workaround · 2026-10-12: 1Technical Details · 2026-09-22: 2Technical Details · 2026-09-23: 1Technical Details · 2026-10-04: 1Technical Details · 2026-10-12: 109-2209-2310-0410-12
Signal classification3 categories
Patch
350.0%
Exploit
233.3%
Disclosure
116.7%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-223
Exploit2Patch1
2026-09-231
Disclosure1
2026-10-041
Patch1
2026-10-121
Patch1
Full discourse6 posts
  • Ryx@PadhiyarRushi
    Disclosure

    nginx ignition unauth admin account creation via race! CVE-2026-61628: onboarding race condition allows unauthenticated admin account creation. Companion issue CVE-2026-61629 is an Accept-Language header parser bypass enabling ~75x CPU amplification. Fresh disclosures worth checking if you run the project. https://vulnso.com/vuln/nginx-ignition-has-unauthenticated-admin-account-creation-via-onboarding-race-condition #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #RCE

    Post summary

    The text discloses two recently reported vulnerabilities in nginx ignition: CVE-2026-61628 (onboarding race condition leading to unauthenticated admin account creation) and CVE-2026-61629 (Accept-Language header parser bypass causing CPU amplification). No active exploitation, exploit code, or remediation steps are mentioned.

    000148931
    954 followersView on X
  • abraxas@abraxas_null
    Exploit

    nginx-ignition exploit! unauthorized admin account creation. SSL cert creation, virtual host take-over ... all sorts of stuff. exploit: https://github.com/abraxas/CVE-2026-61628 lab write-up: https://abraxaslabs.tech/research/CVE-2026-61628

    Post summary

    The post announces an exploit for CVE-2026-61628 with a direct link to GitHub code and technical impact details, prioritizing exploit/tool availability without active exploitation or patch references.

    02084416
    635 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 nginx-ignition'da CVE-2026-61628 | CVSS 8.1 Yüksek seviyeli güvenlik açığı! nginx-ignition < 2.41.1 sürümlerinde, onboarding aşamasındaki sistemlerde bulunan race condition açığı, kimlik doğrulaması olmadan tam yetkili yönetici hesabı oluşturulmasına izin veriyor. Çözüm: 2.41.1+ sürümüne güncellemek.

    Post summary

    The text discloses CVE-2026-61628, a high-severity race condition in nginx-ignition allowing unauthenticated admin creation, and explicitly directs users to update to version 2.41.1+ as the primary remediation action.

    121311.9K
    2.5K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-61628: Ignition nginx UI, CVSS 8.1. Unauthenticated attacker can create a full admin via TOCTOU in the onboarding endpoint. Patch still under review, so restrict exposure now. https://www.valtersit.com/cve/CVE-2026-61628 #CVE #infosec #nginx #Ignition #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text announces CVE-2026-61628 in Ignition nginx UI (CVSS 8.1), detailing a TOCTOU vulnerability allowing unauthenticated admin creation, and recommends restricting exposure as a workaround while a patch is under review.

    00020106
    1.1K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-61628 (CVSS 8.1) - nginx ignition pre-auth RCE via race condition. Unauthenticated attackers can create admin accounts during onboarding. Patch to v2.41.1 immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/vKuAz4fwuX

    Post summary

    The tweet discloses a high-severity pre-authentication RCE in nginx ignition (CVE-2026-61628) caused by a race condition allowing unauthenticated admin account creation, and urges immediate patching to version 2.41.1.

    0000044
    146 followersView on X
  • abraxas@abraxas_null
    Exploit

    @ridvanyagli This is a good one! Exploit: https://github.com/abraxas/CVE-2026-61628 Lab Write-up: https://abraxaslabs.tech/research/CVE-2026-61628

    Post summary

    The tweet highlights a GitHub repository containing exploit code for CVE-2026-61628, indicating functional exploit availability, while providing no details on the vulnerability itself, patches, or active exploitation.

    00000169
    146 followersView on X

Explore more

Back to dashboard