CVE-2021-29441: the Nacos backdoor you open by lying about your User-Agent

CVE-2021-29441 lets anyone who can merely reach an Alibaba Nacos server perform any administrative action with no credentials. The flaw lives in the AuthFilter servlet filter, which was built with a shortcut so that servers in a cluster could talk to each other without logging in. The check it uses to recognise a peer server is embarrassingly simple: does the request's User-Agent header start with the string Nacos-Server? Because User-Agent is a header the client fully controls, anyone can claim to be a peer server -- and the filter waves them straight through. Nacos routinely holds database credentials, API keys and downstream service secrets in its config store, so an unauthenticated admin foothold there is an unusually rich prize.

What the flaw actually is

When Nacos authentication is switched on (-Dnacos.core.auth.enabled=true), the AuthFilter is supposed to enforce it on every request. Inside the filter sits a whitelist branch: if the internal flag isEnableUserAgentAuthWhite() is true -- the default in vulnerable builds -- and the request's User-Agent starts with the constant Nacos-Server, the filter skips the rest of the authentication chain. That is textbook CWE-290, Authentication Bypass by Spoofing: the server authenticates a string the caller chooses. The proof is a one-line differential -- the same request is rejected without the header and accepted with it.

# Rejected: 403 Forbidden
curl -s -X POST 'http://TARGET:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld'

# Accepted: 200, body 'true' -- authentication skipped
curl -s -X POST -A 'Nacos-Server' 'http://TARGET:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld'

The intent was benign -- let peer nodes skip a login -- but authenticating on an attacker-controlled header turns an internal convenience into a public bypass. Once the filter is short-circuited, the whole admin surface is reachable unauthenticated: creating users via POST /nacos/v1/auth/users, and reading or overwriting every namespace and configuration item. GitHub Security Lab, who reported it, describe it plainly as a backdoor in the filter. Worth noting a sibling issue, CVE-2021-29442: the /nacos/v1/cs/ops/derby endpoint lacks the @Secured annotation, exposing the embedded Derby SQL interface without even a header trick.

The exploitation chain

From a single spoofed header to full config-store compromise. The clearest real-world illustration is JADEPUFFER: after an AI agent gained a foothold via a Langflow RCE (CVE-2025-3248), it found an exposed Nacos server, bypassed authentication with this flaw (in parallel with a forged JWT built from Nacos's public default signing key), minted a rogue admin, and encrypted the entire config store. Each stage has a cheap chokepoint, and the most effective one is simply never exposing the Nacos port to an untrusted network.

Am I affected?

Every Nacos release before 1.4.1 is directly vulnerable to the User-Agent trick. But the honest answer is broader: because the 1.4.1 fix shipped an insecure serverIdentity default, anything on 1.4.1 through 2.2.0.0 that was never explicitly reconfigured is also bypassable, and any instance running with nacos.core.auth.enabled=false has no authentication at all. The safe target is 1.4.5 / 2.2.0.1+ with the defaults changed. Fingerprint a server's version safely with an unauthenticated GET to /nacos/v1/console/server/state (read-only, returns a version field) and compare it against that floor. The decisive question, though, is exposure: is the Nacos port reachable from a network you do not trust?

Exploited in the wild -- carefully stated

The strongest and most recent evidence is JADEPUFFER, which Sysdig documented on 1 July 2026 as the first end-to-end AI-driven ("agentic") ransomware operation. After an LLM agent gained initial access through a Langflow RCE, it autonomously located an internet-exposed Nacos server and attacked it two ways at once -- this User-Agent bypass and a forged JWT using Nacos's long-public default signing key. It created a rogue admin account (xadmin), then used MySQL's AES_ENCRYPT() to encrypt all 1,342 configuration items, dropped the original tables, and left a README_RANSOM table. Two details stand out: the agent self-corrected a failed admin-creation payload roughly 31 seconds later without human help, and the AES key was random and never saved -- so the data is unrecoverable even if the ransom is paid. Separately, exposed Nacos has long been a commodity target for cryptojacking crews such as Kinsing that hunt internet-facing middleware to build Linux mining botnets.

Detection & hunting

The single most useful fact for defenders: the User-Agent value Nacos-Server (and the default serverIdentity: security header) should only ever appear on genuine intra-cluster traffic from known peer IPs. Anything else carrying that marker to a /nacos admin path is high-signal on its own -- you do not need to match a specific payload. Watch the header, then watch the host.

• Request-side: any request to /nacos/v1/auth/users, /nacos/v1/cs/configs or /nacos/v1/ns/ whose User-Agent starts with Nacos-Server, or that carries serverIdentity: security, from a source that is not a known cluster peer. Also flag admin requests with a trailing slash (/nacos/v1/auth/users/) -- the method-lookup bypass variant.
• Safe exposure check: GET /nacos/v1/console/server/state (read-only) and flag anything below the 1.4.5 / 2.2.0.1 floor; enumerate ports 8848/9848/9849 from an external vantage. Prefer this over an active exploit check.
• Post-exploit on the host: hunt for rogue admin users in the Nacos users/roles tables (reconcile against your known set -- JADEPUFFER used xadmin), for config values that are now unexpected AES blobs, dropped config_info tables, or a stray README_RANSOM table.
• Forged-JWT tell: authenticated actions with no matching successful login can indicate a token minted with the default token.secret.key rather than a real session. Validate before acting; rotate the key regardless.

# PROPOSED, NOT OFFICIAL - flags a request carrying the Nacos cluster-peer marker
# to a Nacos admin path. Map the field names to your proxy/web-log schema and
# allowlist known Nacos peer source IPs to cut false positives.
title: Nacos CVE-2021-29441 User-Agent / serverIdentity auth bypass
status: experimental
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/nacos/v1/auth/users'
      - '/nacos/v1/cs/configs'
      - '/nacos/v1/ns/'
  selection_marker:
    - c-useragent|startswith: 'Nacos-Server'
    - cs-headers|contains: 'serverIdentity: security'
  condition: selection_path and selection_marker
fields: [src_ip, c-useragent, cs-uri-stem, sc-status]
level: high

What to do now

1. Contain exposure first. If a Nacos port (8848, or 2.x gRPC 9848/9849) is reachable from the internet or an untrusted segment, network-segment it now. The whole bug class is pre-auth, so reachability is the vulnerability -- this single control neutralises the User-Agent trick, the serverIdentity default and the forged-JWT path at once.
2. Upgrade to 1.4.5 / 2.2.0.1 or later -- past both the User-Agent and serverIdentity-default bypasses. Do not stop at 1.4.1.
3. Change the defaults. Set nacos.core.auth.enable.userAgentAuthWhite=false, give nacos.core.auth.server.identity.key/.value unique secret values (never serverIdentity/security), and rotate token.secret.key to a strong unique key. The public default JWT key enables token forgery independent of this CVE.
4. Assume breach if it was ever exposed. Hunt for rogue admin users, tampered or encrypted configs and forged-token activity before you close the ticket -- and rotate every secret Nacos stored, since those configs may already be in an attacker's hands.
5. Prioritise: internet-reachable instances first (hours), internally-reachable next, fully-isolated hardened instances on normal cadence -- and verify that 'isolated' really is.

FAQ

Sources

• NVD -- CVE-2021-29441
• GitHub Security Lab -- GHSL-2020-325/326 (Nacos auth bypass)
• GitHub Advisory Database -- GHSA-36hp-jr8h-556f
• alibaba/nacos -- issue #4701 (serverIdentity / trailing-slash bypass) + PR #4703
• Nacos -- Authentication guide (serverIdentity & token.secret.key defaults)
• ProjectDiscovery -- Nuclei template CVE-2021-29441.yaml
• Tenable -- Nessus plugin 154416 (Nacos < 1.4.1 Authentication Bypass)
• vulhub -- nacos/CVE-2021-29442 (sibling unauth Derby endpoint)
• Sysdig -- JADEPUFFER: agentic ransomware for automated database extortion
• SC Media -- First agentic ransomware JADEPUFFER invades database at machine speed
• The Hacker News -- Kinsing group expands exploited flaws for cryptojacking
• CISA -- Known Exploited Vulnerabilities catalog (JSON feed)