What’s Vulnerable › Vulnerabilities

CVE-2021-41230: OIDC claims not updated from Identity Provider in Pomerium

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-05 · updated 2026-06-17
• Weakness: CWE-863

Description

Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.

Affected products

• pomerium: from 0.14.0 before 0.15.6 — fixed in 0.15.6

How to fix

Upgrade to a fixed version: pomerium 0.15.6. Check the vendor advisory for mitigations.

References

• https://github.com/pomerium/pomerium/pull/2724
• https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfg
• https://github.com/pomerium/pomerium/pull/2724
• https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfg

Get alerted when CVE-2021-41230 or the next vulnerability affects your stack