Description

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-21T15:17:30.290Z",
  "pubdate": "2026-09-21T15:17:30.290Z",
  "executiveSummary": "The Nginx Ignition web interface is susceptible to an unauthenticated administrator account creation vulnerability. The flaw exists within the /api/users/onboarding/finish endpoint, which fails to enforce authentication requirements during the onboarding process. Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition in the user creation logic, an unauthenticated remote attacker can bypass the onboarding state validation to provision a new user account with full ReadWrite administrative privileges. This vulnerability affects all Nginx Ignition versions prior to 2.41.1. Successful exploitation allows an attacker to achieve full administrative control over the affected Nginx instance. Because the vulnerability requires only network reachability to an uninitialized instance, it poses a significant risk to the integrity, confidentiality, and availability of the web server management interface. Organizations must ensure that instances are correctly initialized and updated to prevent unauthorized administrative escalation.",
  "technicalDetails": "The vulnerability resides in the onboarding workflow logic of Nginx Ignition, specifically within the POST /api/users/onboarding/finish API handler. The application fails to require authentication for this endpoint, treating the request as a public operation intended for the initial setup phase. The root cause of the escalation is a classic TOCTOU race condition occurring between the state-check logic (which determines if the onboarding process is already completed) and the subsequent write operation (which commits a new administrative user to the database).\nIn the vulnerable implementation, the application performs a check to verify if the initialization state is still active. If this check passes, the application proceeds to execute the user creation function. Because these two operations are not performed atomically or protected by a locking mechanism, the application state can change between the validation and the commit. An attacker can leverage this window by flooding the server with concurrent requests to the /api/users/onboarding/finish endpoint.\nThe attack flow follows a structured pattern: 1) The attacker identifies a target Nginx Ignition instance in a pre-onboarding state. 2) The attacker submits concurrent POST requests to /api/users/onboarding/finish. 3) Because the application lacks an atomic guard, multiple threads or processes verify that the onboarding is not yet completed simultaneously. 4) The race condition allows these concurrent threads to bypass the completion check, resulting in the successful creation of one or more accounts with full ReadWrite admin permissions. 5) By successfully injecting these credentials, the attacker effectively circumvents the onboarding restriction to obtain unauthorized administrative access.\nThis vulnerability is present in all versions prior to 2.41.1. The impact is critical, as it grants the attacker elevated privileges, allowing for full management of the Nginx configuration, user management, and potentially arbitrary command execution depending on the server-side capabilities exposed via the administrative panel. The lack of authentication requirements at the API level exacerbates the threat, as no pre-existing session or secret is required to initiate the attack. The exploitation does not require special privileges beyond network reachability to the target web interface during the uninitialized state."
}