- Description
- Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- Hype score
- Not currently trending
JADEPUFFER: Sysdig documented the first ransomware operation run end-to-end by an autonomous AI agent. No human at the keyboard. It chained CVE-2025-3248 (Langflow, KEV) → CVE-2021-29441 (Nacos) and encrypted a production DB itself. 🧵 the fix runbook 👇 https://t.co/dCXz
@zerohuntai
8 Jul 2026
6 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
JadePuffer, claimed as the first fully LLM-driven ransomware, exploited CVE-2025-3248 in Langflow, then chained CVE-2021-29441 to reach a production Nacos MySQL server. #DFIR_Radar https://t.co/H5uCUL9Mf7
@DFIR_Radar
6 Jul 2026
136 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
JADEPUFFER Agentic Ransomware Exploits Langflow CVE-2025-3248 and Nacos CVE-2021-29441. https://t.co/bkDNPhMJQb #ThreatIntel #CVE_2025_3248 #CVE_2021_29441 #JADEPUFFER https://t.co/vBblI1lh1r
@threadlinqs
5 Jul 2026
58 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ランサムウェア犯さん、エージェント型AIによる攻撃の完全自動化に成功。Sysdig社報告。脅威をJadePufferと命名。LangflowのCVE-2025-3248から初期アクセスし、MySQLにrootで接続。root認証情報の取得契機は不明。その後
@__kokumoto
2 Jul 2026
1528 Impressions
8 Retweets
19 Likes
11 Bookmarks
0 Replies
1 Quote
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "167EF403-0A27-4951-83BF-0BE274BBA6B7",
"versionEndExcluding": "1.4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]