Improper access control in nats-server - #VU166201
Published: November 13, 2026
Vulnerability identifier: #VU166201
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass required proxy authentication and potentially access or modify protected messaging data.
The vulnerability exists due to improper access control in nats-server when applying connection restrictions from a scoped signing key template. A remote user can establish a direct connection despite an effective template requiring an authenticated proxy to bypass proxy authentication and potentially read or modify protected messaging data.
Both direct JWT authentication and authorization callouts are affected.
Affected software
nats-server
Remediation
Install security update from vendor's website.
nats-server - addressed in versions 2.14.8, 2.15.1