https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T02:02:27.760033+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-34116 cnvd-2021-34116 2026-10-04T02:02:27.829460+00:00 cnvd-2021-34116 https://cve.radiocsirt.org/vuln/euvd-2026-26356 EUVD-2026-26356 2026-10-04T02:02:27.829498+00:00 EUVD-2026-26356 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29442 fkie_cve-2021-29442 2026-10-04T02:02:27.829513+00:00

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)

 https://cve.radiocsirt.org/vuln/ghsa-xv5h-v7jh-p2qh GHSA-xv5h-v7jh-p2qh — Authentication bypass for specific endpoint 2026-10-04T02:02:27.829544+00:00

Affected: Maven: com.alibaba.nacos:nacos-common

The [`ConfigOpsController`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java) lets the user perform management operations like querying the database or even wiping it out. While the [`/data/remove`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L133-L135) endpoint is properly protected with the `@Secured` annotation, the [`/derby`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L99-L100) endpoint is not protected and can be openly accessed by unauthenticated users.

For example, the following request will list the tables of the database: ``` ❯ curl -X GET 'http://console.nacos.io/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st' {"code":200,"message":null,"data":[{"TABLENAME":"APP_CONFIGDATA_RELATION_PUBS"},{"TABLENAME":"APP_CONFIGDATA_RELATION_SUBS"},{"TABLENAME":"APP_LIST"},{"TABLENAME":"CONFIG_INFO"},{"TABLENAME":"CONFIG_INFO_AGGR"},{"TABLENAME":"CONFIG_INFO_BETA"},{"TABLENAME":"CONFIG_INFO_TAG"},{"TABLENAME":"CONFIG_TAGS_RELATION"},{"TABLENAME":"GROUP_CAPACITY"},{"TABLENAME":"HIS_CONFIG_INFO"},{"TABLENAME":"PERMISSIONS"},{"TABLENAME":"ROLES"},{"TABLENAME":"SYSALIASES"},{"TABLENAME":"SYSCHECKS"},{…

 https://cve.radiocsirt.org/vuln/gsd-2021-29442 gsd-2021-29442 2026-10-04T02:02:27.829592+00:00 gsd-2021-29442