Hi, I’m getting messages from our central IT complaining that our Discourse instance is triggering a security warning on CVE-2021-41163, which regards the /webhooks/aws endpoint. I’ve told them that we’ve kept the software up to date since 2021 (we do a “launcher app rebuild” every month automatically) but their scanner is still flagging it as a problem. It’s convinced we’re running a version before 2.7.8 (2021), but we’re on 2026.01.0-latest. So I’m pretty sure their scanner is just mis-parsing the version string, or detecting the existence of the endpoint and complaining about that. I’m 99% sure it’s not a problem, but I need to convince them of that. Is there a clean way of disabling the AWS webhooks endpoint without having to tweak discourse.conf? That would probably mollify them. Of course there’s always that 1% possibility that we’re NOT patched, in which case, I’d be happy to have some way of testing that. I did some grepping through git log but I don’t see a specific reference to that CVE. Advice?

Sounds like a bad CISO then… :roll_eyes: File a bug report at the scanner corp?

[imagem] rbos: So I’m pretty sure their scanner is just mis-parsing the version string, It shouldn’t be too hard to explain to them that there is a new versioning scheme and their scanner doesn’t understand? Which is the same reason why Microsoft skipped Windows 9. Esp since you can prove that this started between 3.6.0beta and 2026.01…

You would really think so. I’ve done that three times, but scanner says bad therefore bad.

Falso positivo CVE-2021-41163

Suporte ao Produto

RGJ (Richard - Communiteq) 6 Janeiro , 2026 22:23 4

Parece um CISO ruim então…

Abra um relatório de bug na empresa do scanner?

Tópico		Respostas	Vistas
Discourse Vulnerability CVE-2021-41163 Self-hosting	10	1657	30 Outubro , 2021
Unable to find discourse version 2.9.0.beta6 Product Support	3	733	4 Julho , 2022
Discourse Vulnerability [False Positive] Product Support	2	1544	10 Junho , 2019
Discourse updates - Microsoft Defender reports detection of Wacatac malware Product Support	7	391	4 Fevereiro , 2025
⚠ v2026.3.0-latest.1 has 33 security fixes, is already 6 days old Product Support	8	537	26 Março , 2026

Falso positivo CVE-2021-41163

Related topics