CVE-2021-29441: Nacos AuthFilter authentication bypass via spoofed User-Agent

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable authentication bypass with full administrative impact, a CVSS score of 9.8, and very high EPSS with public exploit references.

What it is

Nacos before 1.4.1 contains a backdoor in the AuthFilter servlet filter that lets requests bypass authentication checks when authentication is enabled. The bypass keys off the User-Agent HTTP header, which is trivially spoofed, so the authentication control can be skipped entirely. Because Nacos is a service discovery and configuration platform, this exposes a core infrastructure component to unauthenticated administrative access.

Impact

An attacker gains full administrative control of the Nacos server, including reading and modifying service registrations and configuration data. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network via HTTP requests to the Nacos server; no authentication is required because the flaw is the authentication bypass itself, and no user interaction is needed. The only precondition is that the target is configured with nacos.core.auth.enabled=true, which is the configuration the bypass defeats.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.87747, 99.75th percentile) and multiple references are tagged Exploit, indicating public exploit code exists. No ransomware group usage is documented in the record.

What to do

• Upgrade Nacos to version 1.4.1 or later, which contains the patch referenced in the advisory.
• If immediate upgrade is not possible, restrict network access to the Nacos server and its API ports to trusted hosts only.
• Do not rely on the User-Agent header for any authentication or access-control decision; audit custom filters for similar trust assumptions.
• Rotate any credentials or secrets stored in Nacos configuration, since administrative access may have been abused.
• Monitor Nacos audit and access logs for administrative operations from unexpected sources.

Detection

• Search Nacos access logs for administrative API calls that succeeded without valid authentication, especially from unfamiliar source IPs.
• Alert on requests to Nacos endpoints carrying unusual or spoofed User-Agent values associated with the bypass.
• Baseline normal administrative API usage and flag configuration or service-registration changes outside that baseline.
• Review Nacos configuration for nacos.core.auth.enabled=true deployments and verify they are on a patched version.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.