Description
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/nats-io/nats-server | all versions | — | GO-2022-0307 |
| Go | github.com/nats-io/nats-server/v2 | >= 2.0.0, < 2.7.2 | 2.7.2 | GHSA-g6w6-r76c-28j7 |
| Go | github.com/nats-io/nats-streaming-server | >= 0.15.0, < 0.24.1 | 0.24.1 | GHSA-g6w6-r76c-28j7 |
Advisories 1
- WID-SEC-2022-0235 Red Hat Advanced Cluster Management: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Oct 8, 2026