CVE-2021-30181: Apache Dubbo Script Routing Rule Enables Arbitrary Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction and high EPSS make this a top remediation priority despite the absence of KEV listing.

What it is

Apache Dubbo versions prior to 2.6.9 and 2.7.9 support Script routing rules that are parsed and executed using ScriptEngine. Because the rule script is run by default, a crafted routing rule can execute arbitrary code. This matters because routing rules are part of the request path and the flaw is remotely reachable without authentication.

Impact

An attacker can execute arbitrary code in the context of the Dubbo process, leading to full compromise of confidentiality, integrity and availability. No privileges are required beyond the ability to supply or influence a routing rule.

Attack surface

The vulnerability is reachable over the network via the Dubbo routing rule mechanism, as reflected by the CVSS vector AV:N/PR:N/UI:N. No authentication or user interaction is required according to the vector and description.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit references, but EPSS is high at 0.60596 (99.1st percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Apache Dubbo to 2.6.9, 2.7.9 or later, which removes the unsafe default ScriptEngine execution of routing rules.
• If immediate upgrade is not possible, disable or restrict Script routing rule support and avoid loading untrusted routing rules.
• Restrict network access to Dubbo endpoints and admin/registry interfaces so untrusted clients cannot submit routing rules.
• Review and sanitize any externally supplied routing rule configuration before it is parsed by Dubbo.
• Monitor Dubbo logs and configuration changes for unexpected script-based routing rules.

Detection

• Search Dubbo configuration and registry data for routing rules containing script or ScriptEngine content.
• Monitor for unexpected child processes or command execution originating from the Dubbo service process.
• Alert on anomalous outbound network connections from Dubbo hosts that may indicate post-exploitation activity.
• Audit access logs for unauthenticated or unusual clients interacting with Dubbo routing rule interfaces.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.