Nats-server vulnerabilities

2 known vulnerabilities in Nats-server from Linux Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  nkeys: Use of Hard-coded Cryptographic Key

  CVE-2023-46129Oct 31, 2023Nats-io

  NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authen

• 8.8 High severity

  Nats-server: Missing Authorization

  CVE-2022-24450Feb 8, 2022Linux FoundationEPSS 1.33%

  NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.