CVE-2021-29441

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
alibaba	nacos	< 1.4.1

References

https://github.com/advisories/GHSA-36hp-jr8h-556fExploit, Third Party Advisory
https://github.com/alibaba/nacos/issues/4701Exploit, Third Party Advisory
https://github.com/alibaba/nacos/pull/4703Patch, Third Party Advisory
https://github.com/advisories/GHSA-36hp-jr8h-556fExploit, Third Party Advisory
https://github.com/alibaba/nacos/issues/4701Exploit, Third Party Advisory
https://github.com/alibaba/nacos/pull/4703Patch, Third Party Advisory

Timeline

Published: Apr 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294427.5Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the Conf CVE-2021-294435.9jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A1 CVE-2021-294445.9jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 CVE-2021-294455.9jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA CVE-2021-294465.9jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA CVE-2021-294476.5Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Libr CVE-2021-294488.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal,CVE-2021-294497.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were CVE-2021-294504.3Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts a CVE-2021-294519.1Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Toke CVE-2021-294526.5a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in versi CVE-2021-294536.5matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properl