/PLAYBOOK · 2026-08-25

Nacos unauthorized-access hardening: authentication and secure configuration

Default Nacos configs allow unauthorized access: config theft, registry tampering, even RCE. Four-step hardening: enable auth, rotate default keys, restrict sources, upgrade. Full configs and verification commands included.

Scope

For microservice teams using Nacos as config center or service registry. High-risk cases: console reachable from the public internet, default key `SecretKey012345678901234567890123456789012345678901234567890123456789`, version below 2.2.1, auth off. Unauthorized Nacos access yields database passwords, middleware credentials, and the rest of the config set. Treat as high severity; fix now.

Prerequisites

Root or admin on the Nacos host
Console access (default port 8848, gRPC port 9848)
Version confirmed: `curl http://127.0.0.1:8848/nacos/v1/console/health/readiness` or inspect `conf/application.properties`

How it works

Before 2.2.1, console auth is off by default. Historical issues include CVE-2021-29441 (AuthFilter bypass via `User-Agent: Nacos-Server`) and CVE-2021-29442. Unauthenticated console access lets an attacker read all configs (including DB passwords), tamper with service registration, and reach RCE via `nacos-core` deserialization or SQL injection. Even with auth on, if `nacos.core.auth.plugin.nacos.token.secret.key` stays at the default, an attacker forges an admin JWT and logs in.

Procedure

Step 1: Upgrade Nacos to a safe release

Upgrade the server to 2.2.1+ (prefer 2.3.x / 2.4.x). That line enables the auth switch by default and fixes known bypasses:

# Download and replace (2.3.2 as an example)
cd /opt
wget https://github.com/alibaba/nacos/releases/download/2.3.2/nacos-server-2.3.2.tar.gz
tar -zxvf nacos-server-2.3.2.tar.gz
# Stop the service, replace, then start
cd /opt/nacos/bin
sh shutdown.sh && sh startup.sh -m standalone

Step 2: Enable auth and replace the default key

Edit `conf/application.properties`:

# Enable authentication
nacos.core.auth.enabled=true

# Disable the default token; use a randomly generated 32+ character base64 secret
nacos.core.auth.plugin.nacos.token.secret.key=

# Generate a random secret
openssl rand -base64 32

Put the random string into `token.secret.key` and restart:

cd /opt/nacos/bin && sh shutdown.sh && sh startup.sh -m standalone

Step 3: Configure server identity

Stop spoofed server-to-server calls. In `application.properties` (2.2.1+):

nacos.core.auth.server.identity.key=nacos-server-id
nacos.core.auth.server.identity.value=your-random-identity-value

All client `application.yml` files must match:

spring:
  cloud:
    nacos:
      username: nacos
      password: your-strong-password
      server-addr: 10.0.0.5:8848

Step 4: Restrict sources

Firewall 8848 / 9848 to internal and ops IPs only:

# iptables method
iptables -A INPUT -p tcp --dport 8848 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8848 -j DROP
iptables -A INPUT -p tcp --dport 9848 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9848 -j DROP
service iptables save

# firewalld method (choose one as needed)
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=8848 protocol=tcp accept'
firewall-cmd --reload

If the console must face the internet: IP allowlist + strong password + MFA, or VPN only.

Verification

# 1. Unauthorized access should be rejected (return 403/401 rather than data)
curl -s http://your-nacos:8848/nacos/v1/cs/configs?dataId=test -w "\nHTTP %{http_code}\n"

# 2. Auth endpoint works
TOKEN=$(curl -s -X POST "http://your-nacos:8848/nacos/v1/auth/users/login"   -d "username=nacos&password=your-strong-password" | python3 -c "import sys,json;print(json.load(sys.stdin)['accessToken'])")

# 3. Access with token succeeds
curl -s "http://your-nacos:8848/nacos/v1/cs/configs?dataId=test&accessToken=$TOKEN" -w "\nHTTP %{http_code}\n"

FAQ

Q1: Clients get 403 Forbidden after auth is enabled. How to debug?

Check in order: (1) client has `username/password`; (2) client and server versions match (old clients do not speak the new auth API); (3) server `nacos.log` for `token is expired` or `identity invalid` — confirm server identity is identical on both ends.

Q2: All existing clients die after changing token.secret.key?

Expected. Old tokens invalidate immediately. Do it in a business trough. Enable `spring.cloud.nacos.config.refresh-enabled=true` so clients reconnect and fetch a new token. Large fleets: gray restart, batch verify.

Summary

Unauthorized Nacos is one of the highest-impact default-config failures in microservice stacks. After upgrade, auth on, default key replaced, and source IPs restricted, the config center is an auditable service instead of an open box. Put console access behind a bastion with audit. Rotate `token.secret.key` and admin passwords on a schedule.