CVE-2021-26291

CRITICAL

Apache Maven < 3.8.1 - Repository Origin Validation Error via POM Dependency References

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-26291. PoCs published by jpmartins.

AI-analyzed exploit summary This repository provides a technical analysis of CVE-2021-26291, demonstrating how dependency-check-maven flags maven-core-3.6.3.jar with a false positive due to plugin scanning. It includes steps to reproduce the issue and highlights the root cause in the company's parent POM configuration.

Description

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

Exploits (1)

nomisec WRITEUP
by jpmartins · poc
https://github.com/jpmartins/MinimalReproducer

This repository provides a technical analysis of CVE-2021-26291, demonstrating how dependency-check-maven flags maven-core-3.6.3.jar with a false positive due to plugin scanning. It includes steps to reproduce the issue and highlights the root cause in the company's parent POM configuration.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Apache Maven (dependency-check-maven plugin)
No auth needed
Prerequisites: Maven project with dependency-check-maven plugin configured · Parent POM with scanPlugins=true and failBuildOnCVSS=7
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (43)

Core 43
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/04/23/5
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html

Scores

CVSS v3 9.1
EPSS 0.4610
EPSS Percentile 97.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-346
Status published
Products (6)
apache/maven < 3.8.1
oracle/financial_services_analytical_applications_infrastructure 8.0.6.0.0 - 8.0.9.0.0
oracle/goldengate_big_data_and_application_adapters 23.1
org.apache.maven/maven-compat 0 - 3.8.1Maven
org.apache.maven/maven-core 0 - 3.8.1Maven
quarkus/quarkus < 1.13.5
Published Apr 23, 2021
Tracked Since Feb 18, 2026