Executive brief
nginx ignition is a control plane for managing NGINX server instances. The onboarding endpoint that creates the first administrator account is left unauthenticated and vulnerable to a race condition, allowing remote attackers to create multiple admin accounts without authorization. An attacker who gains admin access can fully control the NGINX server and its configuration, including routing, SSL certificates, and access policies.
Technical details
The vulnerability is a time-of-check-to-time-of-use (TOCTOU) race condition in the `POST /api/users/onboarding/finish` endpoint. The endpoint is registered with `authorizer.AllowAnonymous()`, permitting unauthenticated access. The handler checks whether onboarding is already completed, then creates a user with full ReadWrite admin permissions across all modules (Hosts, Streams, Certificates, Settings, Users, NginxServer, etc.). The check and user-creation are not atomic—there is no database transaction, lock, or unique constraint between them. When multiple concurrent requests are sent to the endpoint during pre-onboarding state, each request passes the "already completed?" check and proceeds to create an admin user, resulting in multiple admin accounts being minted and each receiving a valid admin JWT. The attack requires the instance to be in pre-onboarding state (either fresh deployment or after state reset). Atomic enforcement of onboarding completion (via transaction, mutex, or unique constraint) is required to remediate.
Affected products
- nginx ignition <UNKNOWN>
Timeline
- 2026-09-21: disclosed: Advisory published
- 2026: other: CVE-2026-61628 assigned