CVE-2021-41130

CVE-2021-41130 affects Google's Extensible Service Proxy (ESPv1), specifically when configured for JWT authentication and when backend applications rely on the "X-Endpoint-API-UserInfo" header for authorization. The vulnerability allows an attacker to bypass authorization by sending two "X-Endpoint-API-UserInfo" headers, with ESPv1 only replacing the first, leaving a malicious second header for the application to process. Rated MEDIUM with a CVSS score of 5.4, this vulnerability has a network attack vector and low attack complexity, potentially leading to unauthorized access to sensitive information or actions (C:L/I:L). There are no known workarounds, and patching to ESPv1 v1.58.0 or later is required. Currently, there is no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness.