The nginx-ignition interface is vulnerable to a critical race condition that enables unauthenticated remote attackers to gain full administrative access.

The vulnerability is a time of check to time of use race condition (CWE-362) within the onboarding handler at POST /api/users/onboarding/finish. An unauthenticated attacker can exploit this lack of atomicity to bypass the onboarding check and create new administrative accounts.

Successful exploitation grants an attacker full ReadWrite administrative privileges on the target instance. This results in complete compromise of the web server interface, potential data exfiltration, and unauthorized system configuration changes. With a CVSS score of 8.1, this high-severity flaw poses a significant risk to the integrity and availability of managed services.

Immediate Action: Update the nginx-ignition software to version 2.41.1 or the specified fixed commit version immediately.

Proactive Monitoring: Review web server access logs for anomalous, high-frequency POST requests targeting the /api/users/onboarding/finish endpoint.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to the onboarding API endpoints and monitor for unexpected user creation events.

Public Exploit Available: No

The ability for an unauthenticated user to escalate privileges to administrator status represents a severe security failure. Organizations running nginx-ignition must prioritize patching to version 2.41.1 to close this onboarding vulnerability. Failure to remediate this flaw leaves the administrative interface exposed to unauthorized takeover.