CVSS 3.1
6.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LCVE-2022-29946
Medium (6.3). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/nats-io/nats-server/v2 2.8.2.
NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2h2x-8hh2-mfq8 | Go | github.com/nats-io/nats-server/v2 | <2.8.2 | 2.8.2 |
| GHSA-2h2x-8hh2-mfq8 | Go | github.com/nats-io/nats-streaming-server | <0.24.6 | 0.24.6 |
| GO-2024-2980 | Go | github.com/nats-io/nats-server | all versions | no fix published |
| GO-2024-2980 | Go | github.com/nats-io/nats-server/v2 | <2.8.2 | 2.8.2 |
| GO-2024-2980 | Go | github.com/nats-io/nats-streaming-server | <0.24.6 | 0.24.6 |