CVE-2021-41230mediumCWE-863

CVE-2021-41230: medium-severity vulnerability in pomerium

OIDC claims not updated from Identity Provider in Pomerium

Published · Updated

Follow this CVE+ Monitor pomerium+ Monitor github.com/pomerium/pomerium

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.9%
Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
pomerium · pomerium
Related CVEs — pomerium

In the same product, most dangerous first.

CVE-2021-39204HIGHExcessive CPU usage in PomeriumEPSS 1.7%CVE-2021-39162HIGHIncorrect handling of H2 GOAWAY + SETTINGS framesEPSS 1.6%CVE-2021-39206HIGHIncorrect Authorization with specially crafted requestsEPSS 1.5%CVE-2022-24797MEDIUMExposure of Sensitive Information in PomeriumEPSS 1.4%CVE-2023-33189CRITICALIncorrect Authorization with specially crafted requestsEPSS 0.9%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.7%