{"cve":"CVE-2021-29442","nvd":{"published":"2021-04-27T21:15:08.030","modified":"2026-06-17T03:47:38.993","status":"Modified","description":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-306"],"references":["https://github.com/advisories/GHSA-36hp-jr8h-556f","https://github.com/alibaba/nacos/issues/4463","https://github.com/alibaba/nacos/pull/4517","https://github.com/advisories/GHSA-36hp-jr8h-556f","https://github.com/alibaba/nacos/issues/4463"],"products":["alibaba:nacos"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2021-29442","score":0.65717,"percentile":0.99265,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-36hp-jr8h-556f","url":"https://osv.dev/vulnerability/GHSA-36hp-jr8h-556f","summary":"Authentication Bypass","modified":"2026-07-08T06:49:40.462036344Z","packages":[{"ecosystem":"Maven","name":"com.alibaba.nacos:nacos-common","purl":"pkg:maven/com.alibaba.nacos/nacos-common","ranges":["<1.4.1"],"fixed":["1.4.1"]}]},{"id":"GHSA-xv5h-v7jh-p2qh","url":"https://osv.dev/vulnerability/GHSA-xv5h-v7jh-p2qh","summary":"Authentication bypass for specific endpoint","modified":"2026-07-08T06:49:40.462036344Z","packages":[{"ecosystem":"Maven","name":"com.alibaba.nacos:nacos-common","purl":"pkg:maven/com.alibaba.nacos/nacos-common","ranges":["<1.4.1"],"fixed":["1.4.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}