CVE-2026-61628

Go/github.com/lucasdillmann/nginx-ignition CVE-2026-61628: high 8.1, EPSS 0.43%

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Action: Upgrade github.com/lucasdillmann/nginx-ignition to 0.0.0-20260621194639-0586b4e55ab or later.

go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260621194639-0586b4e55ab

Affected

Fixed versions

Sources

• osv: GHSA-pxcx-fv34-x9p5
• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5
• https://nvd.nist.gov/vuln/detail/CVE-2026-61628
• https://github.com/lucasdillmann/nginx-ignition/pull/131
• https://github.com/lucasdillmann/nginx-ignition/commit/0586b4e55ab780676d3553a2592979dfa2fb0183
• https://github.com/lucasdillmann/nginx-ignition
• https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.41.1

CVE-2026-61628 · published 2026-09-21T21:54:42Z · modified 2026-09-28T17:10:54.678370071Z · JSON

Go/github.com/lucasdillmann/nginx-ignition CVE-2026-61628: unknown, EPSS 0.43%

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6540
• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5
• https://nvd.nist.gov/vuln/detail/CVE-2026-61628
• https://github.com/lucasdillmann/nginx-ignition/commit/0586b4e55ab780676d3553a2592979dfa2fb0183
• https://github.com/lucasdillmann/nginx-ignition/pull/131
• https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.41.1

CVE-2026-61628 · published 2026-09-28T16:43:40Z · modified 2026-09-28T17:00:26.227151167Z · JSON