CVE-2026-61628

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-61628 CVE-2026-61628 nginx-ignition 2.41.0 - lucasdillmann I am @abraxasnull. Loopback lab. The client is CVE-2026-61628-Abraxas-Labs.py. Onboarding is anonymous. First-boot POST /api/users/onboarding/finish...

GO-2026-6537 nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition

nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition...

GO-2026-6539 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition

nginx ignition has ParseAcceptLanguage separator bypass that enables 75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition...

GO-2026-6540 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

Linux Distros Unpatched Vulnerability : CVE-2026-61629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in...

Linux Distros Unpatched Vulnerability : CVE-2026-61630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused...

Linux Distros Unpatched Vulnerability : CVE-2026-61628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticat...

Exploit for CVE-2026-61628

abraxaslabs.tech · github.com/abraxas ·&...

UBUNTU-CVE-2026-61628

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

UBUNTU-CVE-2026-61630

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

UBUNTU-CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61628

creationtimestamp| type| source ---|---|--- 2026-09-21 22:32:02+00:00| seen| https://gist.github.com/alon710/c22586b9d9c77f8331c17f01285d9c0d 2026-09-21 22:35:02+00:00| published-proof-of-concept| https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5 2026-09-21...

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...

GHSA-PXCX-FV34-X9P5 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...

GHSA-JR34-H97M-9HPX nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

GHSA-HF33-Q6CF-C66F nginx ignition has TOTP Reuse During Validity Window

Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the...

nginx ignition has TOTP Reuse During Validity Window

Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the...

CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61630

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...