Is CVE-2026-61630 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61630 being exploited in the wild.

How severe is CVE-2026-61630?

Medium severity, with a CVSS score of 4.2, published 21 September 2026.

Which products and versions are affected?

github.com/lucasdillmann/nginx-ignition (Go) >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6, SEMVER:introduced=0.0.0-20260217145239-1cbfae0296f1,fixed=0.0.0-20260328015550-8d35e1eb5dd6.

Is there a fix for CVE-2026-61630?

Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61630 attacked?

It is attacked over the network.

Am I affected by CVE-2026-61630?

Check whether you run github.com/lucasdillmann/nginx-ignition (Go) or Nginx Ignition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61630: nginx ignition TOTP reuse during validity window

Q: Is there a fix for CVE-2026-61630?

Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61630 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-61630?

Check whether you run github.com/lucasdillmann/nginx-ignition (Go) or Nginx Ignition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61630 · Severity: medium · CVSS 4.2 · Published 2026-09-21

nginx ignition is an authentication system that supports two-factor authentication via time-based one-time passwords (TOTP). A design flaw allows an attacker to reuse a valid TOTP code multiple times within its standard 30-second validity window, potentially bypassing two-factor authentication if they obtain a code through phishing, traffic interception, or social engineering.

Technologies: github.com/lucasdillmann/nginx-ignition (Go). Vendors: Go, NGINX.

Quick answers

Is CVE-2026-61630 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61630 being exploited in the wild.
How severe is CVE-2026-61630?: Medium severity, with a CVSS score of 4.2, published 21 September 2026.
Which products and versions are affected?: github.com/lucasdillmann/nginx-ignition (Go) >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6, SEMVER:introduced=0.0.0-20260217145239-1cbfae0296f1,fixed=0.0.0-20260328015550-8d35e1eb5dd6.
Is there a fix for CVE-2026-61630?: Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61630 attacked?: It is attacked over the network.
Am I affected by CVE-2026-61630?: Check whether you run github.com/lucasdillmann/nginx-ignition (Go) or Nginx Ignition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 or later
```
go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260328015550-8d35e1eb5dd6
```

Technical details

The vulnerability stems from incomplete implementation of TOTP validation logic. The underlying pquerna/otp Go package does not enforce single-use semantics for TOTP codes, requiring applications to separately track and deny reused codes within the validity window. nginx ignition fails to implement this check, allowing an attacker who captures or obtains a valid TOTP to submit it repeatedly during the 30-second window without rejection. The attack requires knowledge of a valid code but no authentication credentials. Remediation involves maintaining a deny-list of recently-used TOTP codes scoped to each user and checking new submissions against this list; codes can be purged after their validity window expires.

Affected products

nginx nginx ignition

Identifiers

CVE-2026-61630
GHSA-hf33-q6cf-c66f
GO-2026-6537

Timeline

2026-09-21: disclosed
2026: other: CVE-2026-61630 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.