Skip to content
OpenAdvisories

Package · Go

github.com/lucasdillmann/nginx-ignition

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.1
    CVE-2026-61628 Public exploit

    nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

    nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-t…

    lucasdillmann nginx-ignition github.com/lucasdillmann/nginx-ignition Go
  • High 7.5
    CVE-2026-61629

    nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

    nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `A…

    lucasdillmann nginx-ignition github.com/lucasdillmann/nginx-ignition Go
  • Medium 4.2
    CVE-2026-61630

    nginx ignition has TOTP Reuse During Validity Window

    nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

    lucasdillmann nginx-ignition github.com/lucasdillmann/nginx-ignition Go