Is CVE-2026-61628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61628 being exploited in the wild.

How severe is CVE-2026-61628?

High severity, with a CVSS score of 8.1, published 21 September 2026.

Which products and versions are affected?

github.com/lucasdillmann/nginx-ignition (Go) < 0.0.0-20260621194639-0586b4e55ab, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20260621194639-0586b4e55ab.

Is there a fix for CVE-2026-61628?

Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260621194639-0586b4e55ab or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61628 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61628?

Check whether you run github.com/lucasdillmann/nginx-ignition (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61628: nginx ignition unauthenticated admin account creation via onboarding race condition

Q: Is there a fix for CVE-2026-61628?

Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260621194639-0586b4e55ab or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61628 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-61628?

Check whether you run github.com/lucasdillmann/nginx-ignition (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61628 · Severity: high · CVSS 8.1 · Published 2026-09-21

nginx ignition is a control plane for managing NGINX server instances. The onboarding endpoint that creates the first administrator account is left unauthenticated and vulnerable to a race condition, allowing remote attackers to create multiple admin accounts without authorization. An attacker who gains admin access can fully control the NGINX server and its configuration, including routing, SSL certificates, and access policies.

Technologies: github.com/lucasdillmann/nginx-ignition (Go). Vendors: Go.

Quick answers

Is CVE-2026-61628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61628 being exploited in the wild.
How severe is CVE-2026-61628?: High severity, with a CVSS score of 8.1, published 21 September 2026.
Which products and versions are affected?: github.com/lucasdillmann/nginx-ignition (Go) < 0.0.0-20260621194639-0586b4e55ab, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20260621194639-0586b4e55ab.
Is there a fix for CVE-2026-61628?: Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260621194639-0586b4e55ab or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61628 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61628?: Check whether you run github.com/lucasdillmann/nginx-ignition (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260621194639-0586b4e55ab or later
```
go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260621194639-0586b4e55ab
```

Technical details

The vulnerability is a time-of-check-to-time-of-use (TOCTOU) race condition in the `POST /api/users/onboarding/finish` endpoint. The endpoint is registered with `authorizer.AllowAnonymous()`, permitting unauthenticated access. The handler checks whether onboarding is already completed, then creates a user with full ReadWrite admin permissions across all modules (Hosts, Streams, Certificates, Settings, Users, NginxServer, etc.). The check and user-creation are not atomic—there is no database transaction, lock, or unique constraint between them. When multiple concurrent requests are sent to the endpoint during pre-onboarding state, each request passes the "already completed?" check and proceeds to create an admin user, resulting in multiple admin accounts being minted and each receiving a valid admin JWT. The attack requires the instance to be in pre-onboarding state (either fresh deployment or after state reset). Atomic enforcement of onboarding completion (via transaction, mutex, or unique constraint) is required to remediate.

Affected products

nginx ignition <UNKNOWN>

Identifiers

CVE-2026-61628
GHSA-pxcx-fv34-x9p5
GO-2026-6540

Timeline

2026-09-21: disclosed: Advisory published
2026: other: CVE-2026-61628 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.