CVE-2021-29441
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.
Early warning: exploitation observed
- Exploitation observed since Dec 1, 2023
- Not yet in the official CISA catalogue
- First attack observed 947 days after disclosure
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Source: VulnCheck KEV · Aug 24, 2026 Aug 23, 2026 Aug 22, 2026 Aug 21, 2026 Aug 20, 2026 Aug 20, 2026
CVSS score8.6 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NWeakness type (CWE)CWE-290, CWE-290
Vendorsalibaba
Affected products
| Vendors | Prodotto | Versioni |
|---|---|---|
| alibaba | nacos | < 1.4.1 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.