Detections
Analytics

SCA: security update for github.com/lucasdillmann/nginx-ignition (GHSA-pxcx-fv34-x9p5)

high Tenable Self-Hosted Container Security Plugin ID 448253

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST
 /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full
 ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the
 "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote
 unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator
 account for themselves — and concurrent requests can create multiple admin accounts in a single race.
 Version 2.41.1 patches the issue. (CVE-2026-61628)

Solution

Update the github.com/lucasdillmann/nginx-ignition library and its related packages to version 0.0.0-20260621194639-0586b4e55ab or later.

See Also

https://github.com/advisories/GHSA-pxcx-fv34-x9p5

Plugin Details

Severity: High

ID: 448253

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/23/2026

Updated: 9/23/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.28

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-61628

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/21/2026

Vulnerability Publication Date: 9/21/2026

Reference Information

CVE: CVE-2026-61628

cwe: CWE-362