CVE-2026-61628High· 8.1▾ MidnightPoC availablenginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
1 GitHub repo
0.4% → 0.4%
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/lucasdillmann/nginx-ignition < 0.0.0-20260621194639-0586b4e55abPatched in:
github.com/lucasdillmann/nginx-ignition 0.0.0-20260621194639-0586b4e55abField changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61629High· 7.5nginx ignition is a user interface for the nginx web server
CVE-2026-61630Medium· 4.2nginx ignition is a user interface for the nginx web server
CVE-2026-100394Medium· 6.5Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool
CVE-2026-105163Medium· 5.3A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2
CVE-2026-10565Low· 3.1Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition
CVE-2022-3635Medium· 5.5A vulnerability, which was classified as critical, has been found in Linux Kernel