{"advisories":[{"id":"GHSA-36hp-jr8h-556f","source":"ghsa","title":"Authentication Bypass","url":"https://github.com/advisories/GHSA-36hp-jr8h-556f"}],"cve":"CVE-2021-29441","epss":{"score":0.83483},"mitre":{"cpes":[],"created":"2021-04-27T20:20:20+00:00","description":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2021/29xxx/CVE-2021-29441.json","references":["https://github.com/advisories/GHSA-36hp-jr8h-556f","https://github.com/alibaba/nacos/issues/4701","https://github.com/alibaba/nacos/pull/4703"],"title":"Authentication bypass","updated":"2024-08-03T22:02:51.975000+00:00","vendors":[],"weaknesses":["CWE-290"]},"nvd":{"cpes":["cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*"],"created":"2021-04-27T21:15:07.993000+00:00","description":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.","metrics":{"cvssV2_0":{"score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"cvssV3_0":{},"cvssV3_1":{"score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2021/CVE-2021-29441.json","references":["https://github.com/advisories/GHSA-36hp-jr8h-556f","https://github.com/alibaba/nacos/issues/4701","https://github.com/alibaba/nacos/pull/4703"],"title":null,"updated":"2026-06-17T03:47:38.877000+00:00","vendors":["alibaba","alibaba$PRODUCT$nacos"],"weaknesses":["CWE-290"]},"opencve":{"changes":[],"cpes":{"data":["cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2021-04-27T20:20:20+00:00","provider":"mitre"},"description":{"data":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{"score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"provider":"nvd"},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.83483},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/advisories/GHSA-36hp-jr8h-556f","https://github.com/alibaba/nacos/issues/4701","https://github.com/alibaba/nacos/pull/4703"],"providers":["mitre","nvd"]},"title":{"data":"Authentication bypass","provider":"mitre"},"updated":{"data":"2024-11-21T06:01:06.293000+00:00","provider":"nvd"},"vendors":{"data":["alibaba","alibaba$PRODUCT$nacos"],"providers":["nvd"]},"weaknesses":{"data":["CWE-290"],"providers":["mitre","nvd"]}}}