Nginx Ignition
Monthly
Unauthenticated administrator account creation in nginx-ignition affects deployments running versions prior to 2.41.1 that are still in their pre-onboarding state. The endpoint POST /api/users/onboarding/finish is registered as anonymous and, because its "onboarding already completed?" check is not atomic with the subsequent user write, a remote unauthenticated attacker (CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N, base 8.1) who can reach such an instance can create a full ReadWrite administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race. No public exploit identified at time of analysis, and the practical window is narrow: exploitation requires the instance to be network-reachable while deployed but before a legitimate operator has completed onboarding - once onboarding is legitimately finished, the path is guarded.
Unauthenticated denial of service in nginx-ignition 2.29.0 through 2.40.0 lets any remote client that can reach the management API burn roughly 2.4 seconds of server CPU per request by sending a GET whose Accept-Language header is built from underscore-separated malformed language tags, since the gin i18n middleware parses the raw header unconditionally with no size or shape limit. Impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): ten concurrent attackers saturate a ten-core host for the duration of the attack while consuming about 10 MiB/s of upstream bandwidth, with no path to data access or code execution. No public exploit code identified at time of analysis and no CISA KEV entry; the vendor-released patch 2.40.1 fixes the issue.
nginx-ignition versions 2.33.0 through 2.35.0 do not enforce single-use semantics on TOTP one-time codes, so a code that has already been used to authenticate can be replayed again within its normal 30-second validity window. Only accounts with OTP 2FA enabled are affected, and exploitation requires the attacker to already hold the victim's password plus a live-interception position (for example an adversary-in-the-middle phishing proxy) to capture the code as the victim types it, which is why the independent assessment treats this as a genuine but low-priority authentication weakness rather than an emergency. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); nginx-ignition 2.35.1 patches the issue.
Unauthenticated administrator account creation in nginx-ignition affects deployments running versions prior to 2.41.1 that are still in their pre-onboarding state. The endpoint POST /api/users/onboarding/finish is registered as anonymous and, because its "onboarding already completed?" check is not atomic with the subsequent user write, a remote unauthenticated attacker (CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N, base 8.1) who can reach such an instance can create a full ReadWrite administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race. No public exploit identified at time of analysis, and the practical window is narrow: exploitation requires the instance to be network-reachable while deployed but before a legitimate operator has completed onboarding - once onboarding is legitimately finished, the path is guarded.
Unauthenticated denial of service in nginx-ignition 2.29.0 through 2.40.0 lets any remote client that can reach the management API burn roughly 2.4 seconds of server CPU per request by sending a GET whose Accept-Language header is built from underscore-separated malformed language tags, since the gin i18n middleware parses the raw header unconditionally with no size or shape limit. Impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): ten concurrent attackers saturate a ten-core host for the duration of the attack while consuming about 10 MiB/s of upstream bandwidth, with no path to data access or code execution. No public exploit code identified at time of analysis and no CISA KEV entry; the vendor-released patch 2.40.1 fixes the issue.
nginx-ignition versions 2.33.0 through 2.35.0 do not enforce single-use semantics on TOTP one-time codes, so a code that has already been used to authenticate can be replayed again within its normal 30-second validity window. Only accounts with OTP 2FA enabled are affected, and exploitation requires the attacker to already hold the victim's password plus a live-interception position (for example an adversary-in-the-middle phishing proxy) to capture the code as the victim types it, which is why the independent assessment treats this as a genuine but low-priority authentication weakness rather than an emergency. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); nginx-ignition 2.35.1 patches the issue.