Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/lucasdillmann/nginx-ignition < 0.0.0-20260621194639-0586b4e55ab
Fixed in
0.0.0-20260621194639-0586b4e55ab· Vendor fix available
Issue
POST /api/users/onboarding/finish is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Affected component - Endpoint: POST /api/users/onboarding/finish - Route registration: api/user/routes.go:49 → authorizer.AllowAnonymous(http.MethodPost, "/api/users/onboarding/finish") - Handler: api/user/onboardingfinishhandler.go Technical details The route is explicitly allowed without authentication: The handler reads the onboarding state, returns 403 if already finished, and otherwise creates a user with every permission set to ReadWrite: The gap between (1)…
Recommended action: Upgrade to 0.0.0-20260621194639-0586b4e55ab (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lucasdillmann/nginx-ignition >= 0.0.0-20260126024607-cbaf0fc16ed8, < 0.0.0-20260526022344-0c988fc1277c
Fixed in
0.0.0-20260526022344-0c988fc1277c· Vendor fix available
Issue
The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap characters even though the parser's internal scanner aliases to - before parsing. A single unauthenticated GET request with an Accept-Language header built out of separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Affected versions dillmann.com.br/nginx-ignition v2.40.0 and (per code inspection of main) earlier 2.x versions whose api/common/server/i18n.go middleware…
Recommended action: Upgrade to 0.0.0-20260526022344-0c988fc1277c (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lucasdillmann/nginx-ignition >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6
Fixed in
0.0.0-20260328015550-8d35e1eb5dd6· Vendor fix available
Issue
Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can't be reused. Section 6.5.1 within the Authentication section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs: Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once. The OWASP WSTG also references this as one of their checks to look for: Can the OTPs be used more than once? PoC https://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e Impact Any user who uses 2FA could be impacted if their traffic is able to be captured, they're phished/social engineered, or other methods…
Recommended action: Upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.