Improper access control in nats-server - #VU166203
Published: November 13, 2026
Vulnerability identifier: #VU166203
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass external authorization checks and gain unauthorized read and write access to information.
The vulnerability exists due to improper access control in the authorization callout exemption logic in nats-server when evaluating client-supplied identity fields during connection authentication. A remote user can supply identity fields that identify an exempt service user but do not match the authenticated credentials to skip the external authorization decision and gain unauthorized read and write access to information.
Affected software
nats-server
Remediation
Install security update from vendor's website.
nats-server - addressed in versions 2.14.8, 2.15.1