CVE-2021-41230: OpenID Connect Claims Not Updated in Pomerium
Summary
CVE-2021-41230: Incorrect authorization in github.com/pomerium/pomerium. Affects github.com/pomerium/pomerium versions < 0.15.6. Fixed in 0.15.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pomerium is an open-source identity-aware access proxy that provides secure access to internal applications. It allows users to authenticate with various identity providers (IDPs) and enforces access policies based on user claims. Pomerium is written in Go and is widely used for securing access to web applications.
The vulnerability, identified as CVE-2021-41230, affects the Pomerium package. It specifically pertains to the handling of OpenID Connect (OIDC) claims from the IDP. OIDC claims are used to convey information about the user, such as their roles or group memberships. However, changes to these claims after the initial login are not properly reflected in policy evaluation when using the allowed_idp_claims feature. This can lead to incorrect authorization decisions if a user's claims are modified after login.
Vulnerability Detail
The vulnerability in Pomerium arises from the failure to update OIDC claims from the IDP after the initial login. When using the allowed_idp_claims feature as part of the policy, any changes to a user's claims are not considered during policy evaluation. This means that if a user's claims are modified, Pomerium may make incorrect authorization decisions based on outdated information.
The impact of this vulnerability is that users with modified claims may be granted or denied access to resources incorrectly. For example, if a user's role changes from 'admin' to 'user', Pomerium may still consider them as an 'admin' and allow access to restricted resources.
The vulnerability has been assigned a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: v0.33.4 as of 22 Oct 2026
go get github.com/pomerium/pomerium@v0.33.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.15.6
This is the first release that contains the fix.
go get github.com/pomerium/pomerium@v0.15.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Pomerium is not immediately feasible, a workaround is available. The workaround involves clearing the data on the databroker service, which is responsible for storing user claims. By clearing the Redis cache or restarting the in-memory databroker, the claims will be forced to update from the IDP.
To apply the workaround:
- Clear the Redis cache by executing the appropriate command or using a Redis management tool.
- Alternatively, restart the in-memory databroker service to force claims update.
It is important to note that the workaround is temporary and should be followed by upgrading to the latest version of Pomerium as soon as possible.
Conclusion
The vulnerability in Pomerium (CVE-2021-41230) exposes a potential security risk by not updating OIDC claims from the identity provider after the initial login. This can result in incorrect authorization decisions based on outdated information. To mitigate this vulnerability, it is crucial to update the Pomerium package to version 0.15.6 or later. Additionally, a temporary workaround involving clearing the data on the databroker service is available until the package can be updated. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pomerium/pomerium →
FAQ
Pomerium is an open-source identity-aware access proxy that provides secure access to internal applications. It allows users to authenticate with various identity providers and enforces access policies based on user claims.
OIDC claims are pieces of information about a user that are conveyed by the identity provider during authentication. These claims can include user roles, group memberships, or other attributes.
The vulnerability in Pomerium affects the handling of OIDC claims from the identity provider. Changes to these claims after the initial login are not properly reflected in policy evaluation, leading to potential incorrect authorization decisions.
The vulnerability has been assigned a CVSS score of 5.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to update the Pomerium package to version 0.15.6 or later. This version includes a patch that addresses the issue and ensures proper updating of OIDC claims from the identity provider.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pomerium/pomerium.
