CVE-2021-29442 Scanner
Detects 'Authentication Bypass' vulnerability in nacos affects v. before 1.4.1.
Used 3.1k times · 5.9k assets checked · url
CVE
CVE-2021-29442
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
Attack Vector
Network
Privileges Req.
None
User Interaction
None
nacos
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: nacos
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →