PT-2026-27620 · Nats.Io · Nats Server
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
NATS-Server versions prior to 2.11.15
NATS-Server versions prior to 2.12.6
Description
NATS-Server is a high-performance server for NATS.io, a cloud and edge native messaging system. If a nats-server is run with static credentials for all clients provided via command-line arguments (argv), those credentials are visible to any user who can access the monitoring port if it is enabled. The
/debug/vars API endpoint contains an unredacted copy of argv. As a workaround, configure credentials inside a configuration file instead of via argv, and do not enable the monitoring port if using secrets in argv. Best practice remains to not expose the monitoring port to the Internet, or to untrusted network sources.Recommendations
Update to NATS-Server version 2.11.15 or later.
Update to NATS-Server version 2.12.6 or later.
Configure credentials inside a configuration file instead of via argv.
Do not enable the monitoring port if using secrets in argv.
Do not expose the monitoring port to the Internet or untrusted network sources.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Nats Server