CVE-2021-22160

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
May 26, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-221616.5In OpenWrt 19.07.x before 19.07.7, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected CVE-2021-221667.5An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed methodCVE-2021-221677.5An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attackerCVE-2021-221686.5A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.CVE-2021-221694.3An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.CVE-2021-22174.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.CVE-2021-221707.5Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted contentCVE-2021-221716.5Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if thCVE-2021-221724.3Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releasesCVE-2021-221737.5Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture fileCVE-2021-221747.5Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture fileCVE-2021-221759.8When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions