important · RCE — Nacos
Nacos 3.x exposes administrator-equivalent account creation and configuration control on its server port.
Affects
Nacos 3.x, a service-discovery and configuration-management control plane used by distributed applications.
Misclassified management controllers inherit open-API handling and a separately disabled-by-default authentication switch.
Detail and 4 sources
A reachable anonymous caller can create an account, grant it global wildcard permissions, and then read or alter dependent-service configuration.
Nacos 3.2.4 contains the hardening, but pre-fix images remain accepted and revocation is incomplete.
Sources
Code / PoCCreate nacos-v3-auth-scope-bypass.yaml - Nacos 3.x - Unauthenticated Admin Takeover by Akokonunes · Pull Request #17129 · projectdiscovery/nuclei-templates · GitHubCode / PoCGitHub - mhtsec/nacos-authscope-poc: Nacos 3.x (3.0.0~3.2.3) auth scope misassignment: unauthenticated admin account creation & full takeover PoC, fixed in 3.2.4 · GitHubCode / PoCRelease 3.2.4 (Aug 27th, 2026) · alibaba/nacos · GitHubSecondaryCreate nacos-v3-auth-scope-bypass.yaml - Nacos 3.x - Unauthenticated … · projectdiscovery/nuclei-templates@49ab7d9