CVE-2021-29441

Nacos helps manage service discovery and configuration. This flaw lets an attacker pretend to be an allowed client by changing a web request header, and as a result Nacos can skip the normal “are you logged in?” checks.

If someone can reach your Nacos server under the affected configuration, they may gain admin-level control—like changing settings, interfering with services, or accessing important internal information.

This matters to you if your business runs Nacos (or includes nacos-common) before 1.4.1 and has nacos.core.auth.enabled=true enabled. In that configuration, the attacker does not need a login or user interaction.

Reachability matters: it’s a risk when the Nacos web endpoints are reachable over the network (for example, from the internet or other untrusted networks).

This is RED because the issue allows attackers to bypass authentication and perform administrative tasks without logging in, and it’s reachable over the network. Public proof-of-concept code exists, making it easier for attackers to attempt.

Act now to upgrade past the fixed version and reduce exposure of the Nacos web interface.

1. Confirm product/version:

   • Identify the Nacos deployment version you run.
   • If you deploy via Maven/Java dependencies, confirm your com.alibaba.nacos:nacos-common version.
   • The known fix is com.alibaba.nacos:nacos-common fixed in 1.4.1.

2. Confirm the vulnerability precondition:

   • Check whether nacos.core.auth.enabled=true is set.
   • The findings state the bypass applies when this is enabled.

3. Determine exposure (reachability):

   • Check whether the Nacos service is reachable from untrusted networks.
   • If it’s publicly accessible, treat it as exposed; if it’s only reachable from trusted internal networks, exposure may be reduced but not eliminated.

4. Upgrade to the fixed version:

   • Upgrade Nacos so that com.alibaba.nacos:nacos-common is at least 1.4.1.
   • The vendor fix is referenced in GitHub PR #4703.

5. If upgrading is delayed (temporary containment):

   • Restrict network access to the Nacos web endpoints so they are not reachable from the internet.
   • Use firewall rules/security group controls to allow only required sources.

6. After upgrade, verify:

   • Re-check that the running Nacos version is 1.4.1 or later.
   • Re-check nacos.core.auth.enabled=true is still set as intended.

7. Monitor:

   • Monitor Nacos and edge/proxy logs for unusual administrative activity patterns, especially requests that look like they target authentication/filters.

CISA KEV note: CVE-2021-29441 is not listed in the CISA KEV list (no KEV due date provided by the findings).

Severity: HIGH (CVSS 8.6) with network attack vector and no user interaction required. Weakness type: CWE-290 (authentication bypass).

Mechanism: In Nacos before 1.4.1, when configured with nacos.core.auth.enabled=true, the authentication filter has a backdoor that allows skipping authentication checks by spoofing the HTTP user-agent header.

Exploitation status: Public proof-of-concept exists (2 known). KEV is not listed in CISA KEV. The findings also report sustained press attention.

EPSS: A predicted likelihood is reported (do not treat as a confirmation of real-world exploitation). Since the traffic-light verdict is RED, prioritize remediation.

Attack vector: Network-reachable web requests to Nacos; precondition is authentication being enabled (nacos.core.auth.enabled=true). Once reachable, an unauthenticated attacker may perform administrative tasks.