CVE-2021-29442

The vulnerability in the Nacos platform arises from inadequate access controls on specific endpoints, particularly the /derby endpoint, which is not secured against unauthorized access. This oversight allows unauthenticated users to perform sensitive operations, including querying the database and potentially wiping it entirely. The presence of the @Secured annotation on the /data/remove endpoint indicates an awareness of the need for protection; however, the lack of similar safeguards on the /derby endpoint exposes a critical gap in security. This issue is particularly concerning for installations utilizing embedded storage, such as the Derby database, as it enables malicious actors to exploit this weakness without needing valid credentials.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could leverage automated scripts or manual techniques to send requests to the unsecured /derby endpoint, gaining access to sensitive database operations. Once inside, they could execute commands that might lead to data exfiltration, corruption, or complete deletion of the database. The simplicity of accessing this endpoint without authentication means that even attackers with limited technical skills could potentially exploit the vulnerability, making it a low-barrier entry point for malicious activities. Furthermore, the risk escalates in environments where Nacos is deployed in critical infrastructure or service-oriented architectures, where the integrity and availability of configuration data are paramount.

The real-world impact of this vulnerability can be significant, particularly for organizations relying on Nacos for service discovery and management. A successful attack could result in the loss of critical configuration data, leading to service disruptions and operational downtime. This could have cascading effects on business operations, especially in environments that depend on continuous availability and reliability. The financial implications could include not only direct costs associated with recovery and remediation but also potential reputational damage and loss of customer trust. Organizations may face regulatory scrutiny if sensitive data is compromised, further exacerbating the business risk associated with this vulnerability.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-faceted approach. First, conducting a thorough security audit of Nacos installations is essential to identify any unsecured endpoints and assess the overall security posture. Implementing strict access controls and authentication mechanisms for all endpoints, particularly those that interact with sensitive data, is crucial. Organizations should also consider deploying network segmentation and firewalls to limit exposure to the Nacos service from untrusted networks. Regularly updating the Nacos platform to the latest version, which includes security patches, is vital to ensure that known vulnerabilities are addressed. Additionally, continuous monitoring and logging of access to critical endpoints can help detect unauthorized attempts to exploit the vulnerability, allowing for timely incident response.

In conclusion, the vulnerability in the Nacos platform highlights the importance of robust access controls and security practices in service management environments. The potential for exploitation poses significant risks to organizations, emphasizing the need for proactive measures to safeguard against unauthorized access. By adopting comprehensive detection and mitigation strategies, organizations can enhance their security posture and protect their critical assets from emerging threats.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the Nacos vulnerability CVE-2021-29442. Our telemetry indicates a significant surge in scanning and probing activities aimed at the unprotected /derby endpoint, suggesting increased attacker interest and reconnaissance efforts. Concurrently, new proof-of-concept exploits have emerged publicly, broadening the accessibility of attack tools for less sophisticated threat actors. Although the EPSS score remains high and stable, this uptick in active exploitation attempts elevates the immediate risk to organizations still operating vulnerable Nacos instances with embedded Derby storage. The increased adversary activity underscores the urgency for defenders to prioritize detection and monitoring of anomalous access patterns to this endpoint. While no widespread ransomware campaigns have been directly linked to this vulnerability yet, the growing exploitation trend could facilitate initial access vectors for opportunistic threat groups. Overall, the threat level has intensified from moderate to high due to the combination of increased exploitation activity and expanded exploit availability.

Update 2 — June 16, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting the unprotected /derby endpoint in vulnerable Nacos instances. This surge coincides with the emergence of new proof-of-concept exploits publicly available on GitHub, which have lowered the technical barrier for adversaries to conduct unauthorized management operations, including potential database manipulation or destruction. Despite a declining EPSS score indicating a slight reduction in overall exploit likelihood, our telemetry reveals increased adversary interest and activity, suggesting targeted campaigns or opportunistic scanning efforts are intensifying. This divergence underscores a nuanced threat landscape where exploitability metrics alone may underestimate active exploitation risks. Consequently, the threat level for organizations running embedded Derby storage with affected Nacos versions remains elevated, as attackers leverage these accessible exploits to gain initial footholds or disrupt service availability. The evolving exploitation trend demands heightened vigilance in monitoring anomalous access patterns to the /derby endpoint, as the expanding exploit toolkit broadens the attacker base and attack surface.