CVE-2021-29441

Nacos helps manage service discovery and configuration. This flaw lets an attacker pretend to be an allowed client by changing a web request header, and as a result Nacos can skip the normal “are you logged in?” checks.

If someone can reach your Nacos server under the affected configuration, they may gain admin-level control—like changing settings, interfering with services, or accessing important internal information.

This matters to you if your business runs Nacos (or includes nacos-common) before 1.4.1 and has nacos.core.auth.enabled=true enabled. In that configuration, the attacker does not need a login or user interaction.

Reachability matters: it’s a risk when the Nacos web endpoints are reachable over the network (for example, from the internet or other untrusted networks).

This is RED because the issue allows attackers to bypass authentication and perform administrative tasks without logging in, and it’s reachable over the network. Public proof-of-concept code exists, making it easier for attackers to attempt.

Act now to upgrade past the fixed version and reduce exposure of the Nacos web interface.