CVE-2021-29441

Authentication bypass

HIGH 8.6

At a glance

Source: NVD
EPSS: EPSS 83.25 % · percentile 100 (2026-10-28)
State: PUBLISHED
Published: 2021-04-27 20:20 UTC
Updated: 2024-08-03 22:02 UTC
Assigner: GitHub_M
NVD status: Modified

Description

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

Weaknesses (CWE)

CWE-290 — Authentication Bypass by Spoofing

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	GitHub_M
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-36hp-jr8h-556f — Authentication Bypass
GHSA-xv5h-v7jh-p2qh — Authentication bypass for specific endpoint

European references

ENISA EUVD · EUVD-2021-0744
GCVE · GCVE-0-2021-29441

Affected configurations (NVD CPE)

cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:* < 1.4.1

Affected products

Product	Versions
alibaba · nacos	affected < 1.4.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD