CVE-2021-39206: Incorrect Authorization in Pomerium
Summary
CVE-2021-39206: Incorrect Authorization with specially crafted requests. Affects github.com/pomerium/pomerium across 2 version ranges.
>= 0.11.0, < 0.14.8
>= 0.15.0, < 0.15.1
Fixed in 0.14.8 or 0.15.1, depending on the release line you run. How to fix ↓
Also tracked for
- envoy · Bitnami
The same CVE-2021-39206 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pomerium is an open-source project based on Envoy, a high-performance proxy developed by the Envoy Proxy community. Pomerium provides secure access to internal applications and services. It utilizes path prefix-based authorization policies to make routing and authorization decisions. However, due to vulnerabilities in Envoy, Pomerium is susceptible to incorrect authorization and routing decisions.
Vulnerability Detail
Pomerium is affected by two authorization-related vulnerabilities inherited from Envoy:
- CVE-2021-32777: This vulnerability arises from the incorrect transformation of URLs containing a
#fragmentelement. As a result, there can be a mismatch in path-prefix-based authorization decisions. - CVE-2021-32779: This vulnerability occurs due to the mishandling of duplicate headers, causing the dropping of all but the last header. This can lead to incorrect routing or authorization policy decisions.
These vulnerabilities can be exploited by crafting specific requests, potentially resulting in incorrect authorization or routing decisions by Pomerium.
How To Fix
Latest published version: v0.33.4 as of 22 Oct 2026
go get github.com/pomerium/pomerium@v0.33.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.11.0, < 0.14.80.14.8go get github.com/pomerium/pomerium@v0.14.8 -
>= 0.15.0, < 0.15.10.15.1go get github.com/pomerium/pomerium@v0.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to remove any path prefix-based policies in Pomerium. By removing such policies, the vulnerability can be mitigated until the upgrade can be performed.
Conclusion
Pomerium is susceptible to incorrect authorization and routing decisions due to vulnerabilities inherited from Envoy. To mitigate these vulnerabilities, it is recommended to upgrade to Pomerium v0.14.8 or v0.15.1. Alternatively, removing path prefix-based policies can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pomerium/pomerium →
FAQ
Pomerium is an open-source project that provides secure access to internal applications and services.
Envoy is a high-performance proxy developed by the Envoy Proxy community, on which Pomerium is based.
Pomerium is affected by two vulnerabilities inherited from Envoy: CVE-2021-32777 and CVE-2021-32779. These vulnerabilities can lead to incorrect authorization and routing decisions.
The vulnerabilities can be fixed by upgrading to Pomerium v0.14.8 or v0.15.1, which include an upgraded Envoy binary with the patched vulnerabilities.
A temporary workaround is to remove any path prefix-based policies in Pomerium until the upgrade can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pomerium/pomerium.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
