CVE-2021-29441

High8.6 Published on Apr 27, 2021

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

Early warning: exploitation observed

Exploitation observed since Dec 1, 2023
Not yet in the official CISA catalogue
First attack observed 947 days after disclosure
Confirmed by sensors, not only by reports
Used in ransomware campaigns

Source: VulnCheck KEV · Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Sep 30, 2026 Sep 29, 2026 Sep 28, 2026

CVSS score8.6 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness type (CWE)CWE-290, CWE-290

Vendorsalibaba

Affected products

Vendors	Product	Versions
alibaba	nacos	< 1.4.1

APT

SPECTRE, the backdoor that disables EDRs: inside UAT-10147's arsenal

Recently, Cisco Talos published a two-part analysis of the Chinese-speaking group UAT-10147 , which is active against Windows and Linux web servers on a

Aug 24, 202621:19 7 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database