VulnSocial

CVE-2021-26291Patch(apache / financial_services_analytical_applications_infrastructure)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache financial_services_analytical_applications_infrastructure systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

apache CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-346

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • financial_services_analytical_applications_infrastructure
  • goldengate_big_data_and_application_adapters
  • maven
  • quarkus

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-03-10); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
apacheoraclequarkus
Products
financial_services_analytical_applications_infrastructuregoldengate_big_data_and_application_adaptersmavenquarkus

1 version affected across 4 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-10: 1Mentions · 2026-04-11: 1Patch / Workaround · 2026-03-10: 1Technical Details · 2026-03-10: 1Technical Details · 2026-04-11: 103-1004-11
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-03-101
Patch1
2026-04-111
Disclosure1
Full discourse2 posts
  • PulsePatch.io@pulsepatchio
    Disclosure

    CVE-2021-26291: An origin validation error in `Apache Maven` can lead to supply chain attacks by misusing local artifacts. Assess your build processes. #ApacheMaven #CVE #AppSec https://www.pulsepatch.io/posts/cve-2021-26291-apache-maven-origin-validation-error

    Post summary

    A brief tweet highlights an origin validation flaw in Apache Maven that could enable supply chain attacks through local artifacts, urging users to review their build processes.

    0000047
    11 followersView on X
  • Vulert@vulert_official
    Patch

    🚨 Apache Maven CVE-2021-26291: Maven may follow repositories defined in pom.xml, increasing supply chain risk. Upgrade to Maven 3.8.1+ and use a repository manager to enforce trusted sources. https://vulert.com/vuln-db/CVE-2021-26291 #CyberSecurity #SupplyChainSecurity #ApacheMaven #Vulert https://t.co/LQ7X63HOC9

    Post summary

    The tweet highlights that Maven may follow arbitrary repositories defined in pom.xml, posing a supply chain risk, and advises upgrading to Maven 3.8.1+ with a repository manager to mitigate the issue.

    0000031
    124 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appapachemaven---
Apporaclefinancial_services_analytical_applications_infrastructure---
Apporaclegoldengate_big_data_and_application_adapters23.1--
Appquarkusquarkus---

Explore more

Back to dashboardapache CVEsoracle CVEsquarkus CVEsfinancial_services_analytical_applications_infrastructure vulnerabilities