SB2026063035 - Multiple vulnerabilities in nats-server

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in the queue subscription permission evaluation when handling queue subscription requests. A remote user can use a queue subscription that bypasses a plain subject deny rule to disclose sensitive information.

Exploitation requires valid credentials and a permission configuration that combines plain subject deny rules with queue-specific deny rules.

2) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in the subscription permission system when processing wildcard subscription requests that overlap with wildcard deny rules. A remote user can create a wildcard subscription to receive messages on denied subjects to disclose sensitive information.

The issue requires valid credentials and a permission configuration with overlapping wildcard allow and deny patterns. Queue subscriptions may also affect delivery to legitimate queue consumers.

3) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to bypass authentication and gain privileges associated with inter-server connection types.

The vulnerability exists due to improper authentication in route or leafnode listeners when processing connections before the inter-server CONNECT authentication flow completes. A remote attacker can connect to an affected listener and exploit the parser fast path to bypass authentication and gain privileges associated with inter-server connection types.

The issue occurs when no_auth_user is configured.

Remediation

Install update from vendor's website.

References

• https://github.com/nats-io/nats-server/security/advisories/GHSA-jx8g-9g95-6322
• https://github.com/nats-io/nats-server/security/advisories/GHSA-wh7g-5m82-pmhr
• https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45