CVE-2021-26291

mediumpriority · attend · 49EPSS 0.087 · 95 %ileexploit · PoCDEEUFRRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

8.69% (95th) EPSS

CVSS 6.4 · medium

Is it mine?

27 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-26

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.1

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 4.9

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-346USprimaryCWE-346USCWE-346US

exploits (1)

Public proof-of-concept and weaponised exploit code.

jpmartins/MinimalReproducerContext of CVE-2021-26291 minimal replicatorPoC · poc_in_github

affected products (27)

Products and version ranges known to be affected.

Atlassian Bitbucket <10.0.2all versionscert_bundDE
Atlassian Bitbucket <8.19.25 (LTS)all versionscert_bundDE
Atlassian Bitbucket <9.4.13 (LTS)all versionscert_bundDE
HCL Dominoall versionscert_bundDEcpe:/a:hcltech:domino:-
JFrog Artifactory <7.47.7all versionscert_bundDE
Atlassian Bitbucket< 10.0.2cert_bundDE
Atlassian Bitbucket< 8.19.25 (LTS)cert_bundDE
Atlassian Bitbucket< 9.4.13 (LTS)cert_bundDE
JFrog Artifactory< 7.47.7cert_bundDE
Apache Software Foundation Apache Maven≤ Apache Maven ≤3.8.1enisa_euvdEU
Apache Software Foundation Maven≤ 3.8.8fstec_bduRU
Elastic NV Logstash≤ 8.12.1fstec_bduRU
Google Inc Android Studio≤ 2025.2.3.9fstec_bduRU
OpenSearch Logstash≤ 8.9.0fstec_bduRU
Oracle Corp. Financial Services Analytical Applications Infrastructure8.0.6 → 8.0.9fstec_bduRU
Oracle Corp. Financial Services Analytical Applications Infrastructure8.1.0.0.0 → 8.1.2.0fstec_bduRU
Oracle Corp. GoldenGate Big Data and Application Adapters≤ 23.1fstec_bduRU
АО «СберТех» Platform V SberLinux OS Server≤ 9.2.0-fstecfstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
apache maven< 3.8.1nvdUScpe:2.3:a:apache:maven:*:*:*:*:*:*:*:*

showing 20 of 27

advisories (6)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-1375JFrog Artifactory: Mehrere SchwachstellenDeutsch2022-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
WID-SEC-W-2022-2133JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-KomponentenDeutsch2022-11-20csaf · cert_bundDE
JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar.
WID-SEC-W-2023-0098Apache Maven: Schwachstelle ermöglicht Manipulation von Dateien oder Offenlegung von InformationenDeutsch2021-04-25csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Maven ausnutzen, um Dateien zu manipulieren oder Informationen offenzulegen.
GHSA-2f88-5hg8-9x2xOrigin Validation Error in Apache Maven2021-06-16ghsa · osvUS
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
BIT-maven-2021-26291block repositories using http by default2026-03-10vendor · osvUS
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd certfr NVD CVE.org MITRE

published 2021-04-23modified 2026-06-17

related (922)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-34291US	high8.8OT critical	92.8% (100th)	KEV	2025-12-05
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_…
CVE-2015-4495US	high8.8OT critical	68.6% (99th)	KEV	2015-08-08
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitr…
CVE-2024-23898US	high8.8	67.2% (99th)	Exploit	2024-01-24
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, r…
CVE-2009-1185US	high7.2OT high	80.5% (100th)	Exploit	2009-04-17
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
CVE-2023-29711US	critical9.8	70.3% (99th)	—	2023-06-22
An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.

+917 more

references (140)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan