Medium severity · published Oct 30, 2023
CVE-2023-47090
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Nats-server · Linuxfoundation
2.2.0 before 2.9.23; 2.10.0 before 2.10.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47090
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47090
Mailing List
http://www.openwall.com/lists/oss-security/2023/10/30/1
Vendor Advisory
https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23
Mailing List
https://www.openwall.com/lists/oss-security/2023/10/13/2
More from Nats-server
9.8
CVE-2022-28357
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account
9.8
CVE-2020-26892
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled
8.8
CVE-2026-58253
NATS Server: Route API Auth Bypass
8.8
CVE-2022-24450
NATS nats-server before 2.7.2 has Incorrect Access Control
7.5
CVE-2026-58208
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled