Nacos CVE-2021-29441 Auth Bypass Attempt With Forged JWT (Default token.secret.key)

Duo Tech@duotech

•updated Jul 8, 2026•1•0•4

This rule detects attempts to exploit the Nacos CVE-2021-29441 authentication bypass vulnerability. The vulnerability allows an attacker to bypass authentication by leveraging default or forged JWT tokens, specifically targeting the /nacos/ path with an Authorization header containing a Bearer token starting with 'eyJ'.