Nats Server
CVE-2020-26892
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
AnalysisAI
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
Technical ContextAI
This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled. Affected products include: Linuxfoundation Nats-Server, Fedoraproject Fedora. Version information: before 2.1.9.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.
More in Nats Server
View allNATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings ar
This affects all versions of package github.com/nats-io/nats-server/server. Rated high severity (CVSS 7.5), this vulnera
NATS nats-server before 2.7.2 has Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remote
Authentication bypass in NATS Server (nats-io/nats-server) lets an unauthenticated attacker on an adjacent network conne
Remote denial of service in the NATS Server (nats-io/nats-server) leafnode subsystem allows unauthenticated attackers to
Denial of service in NATS Server (nats-server) MQTT handler allows a remote, unauthenticated client to exhaust server me
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted reques
Remote denial-of-service in NATS Server (nats-server) affects deployments with the WebSocket listener enabled but MQTT d
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise,
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). Rated high s
Protocol injection in NATS Server MQTT support allows an authenticated MQTT client to smuggle control characters (tab, n
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStre
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today