Read the docs
TI-2021-16591 Aliases CVE-2021-39206GHSA-cfc2-wjcm-c8fm

Incorrect Authorization with specially crafted requests

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.

Why it matters now

EPSS 0.01457 73rd percentileScored 2026-11-07
Fix Fixed pomerium (pomerium): 0.14.8, 0.15.1github.com/pomerium/pomerium (Go): 0.14.8, 0.15.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pomeriumpomerium0.11.0 to before 0.14.8; 0.15.0 to before 0.15.10.14.8, 0.15.1Patch availableCNA
—github.com/pomerium/pomerium (Go)0.11.0 to before 0.14.80.14.8Patch availableGHSA-cfc2-wjcm-c8fm
—github.com/pomerium/pomerium (Go)0.15.0 to before 0.15.10.15.1Patch availableGHSA-cfc2-wjcm-c8fm
  • pomerium Vendorpomerium Affected 0.11.0 to before 0.14.8; 0.15.0 to before 0.15.1 Fixed in 0.14.8, 0.15.1 Patch available CNA
  • github.com/pomerium/pomerium (Go) Vendor— Affected 0.11.0 to before 0.14.8 Fixed in 0.14.8 Patch available GHSA-cfc2-wjcm-c8fm
  • github.com/pomerium/pomerium (Go) Vendor— Affected 0.15.0 to before 0.15.1 Fixed in 0.15.1 Patch available GHSA-cfc2-wjcm-c8fm

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*before 1.16.5; 1.17.0 to before 1.17.4; 1.18.0 to before 1.18.4Vulnerableenvoyproxy
cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:*1.19.0Vulnerableenvoyproxy
cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:*0.11.0 to before 0.14.8Vulnerablepomerium
cpe:2.3:a:pomerium:pomerium:0.15.0:*:*:*:*:*:*:*0.15.0Vulnerablepomerium
  • cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* Versions before 1.16.5; 1.17.0 to before 1.17.4; 1.18.0 to before 1.18.4 Vulnerable ·envoyproxy
  • cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:* Versions 1.19.0 Vulnerable ·envoyproxy
  • cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:* Versions 0.11.0 to before 0.14.8 Vulnerable ·pomerium
  • cpe:2.3:a:pomerium:pomerium:0.15.0:*:*:*:*:*:*:* Versions 0.15.0 Vulnerable ·pomerium

Remediation

  • Fix · CNA pomerium (pomerium) Fixed in 0.14.8, 0.15.1
  • Fix · GHSA-cfc2-wjcm-c8fm github.com/pomerium/pomerium (Go) Fixed in 0.14.8 Advisory →
  • Fix · GHSA-cfc2-wjcm-c8fm github.com/pomerium/pomerium (Go) Fixed in 0.15.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39206
  2. 2026-10-03 Alias added: GHSA-cfc2-wjcm-c8fm

References

Advisory 4

Other 2

  • TI-2023-16366 Incorrect Authorization with specially crafted requests CVSS 3.1CRITICAL 10.0
  • TI-2022-08610 Exposure of Sensitive Information in Pomerium CVSS 3.1CRITICAL 9.1
  • TI-2021-16548 Incorrect handling of H2 GOAWAY + SETTINGS frames CVSS 3.1HIGH 8.6
  • TI-2021-18069 OIDC claims not updated from Identity Provider in Pomerium CVSS 3.1HIGH 8.8
  • TI-2021-16589 Excessive CPU usage in Pomerium CVSS 3.1HIGH 7.5
  • TI-2024-26271 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences