CVE-2021-41230

    Dashboard / Vulnerabilities / CVE-2021-41230

    CVE-2021-41230

    Published: 5 Nov 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.

    References: https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfg, https://github.com/pomerium/pomerium/pull/2724

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0071b4e7a5ebcbc1d9b908922bc5c2678fa46f8f
    Fixed -4cb3281af7b5e030c89cefcca51b7f4ce409ee25

    Affected versions

    v0.15.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41230 | CVE-DB