AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

nats-serverGO-2024-2980

NATS Server and Streaming Server fails to enforce negative user permissions

nats-server

CVE-2022-29946 · Published Jul 12, 2024 · updated Mar 3, 2026

Medium6.3
No fix yet
Source advisory

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server

Affected versions

PackageAffectedFixed in
github.com/nats-io/nats-server
Go
all versionsNo fix yet

Changes since it was listed

SeverityOct 15Severity: Unrated to Medium
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Severity from
NVD
Also known as
CVE-2022-29946, GHSA-2h2x-8hh2-mfq8

More nats-server advisories

All nats-server
High 7.5Aug 21, 2024Integer Overflow or Wraparound in NATS Server in github.com/nats-io/nats-serverCVE-2019-13126no fix yetUnscoredAug 21, 2024Import loops in account imports, nats-server DoS in github.com/nats-io/nats-serverGO-2022-0398no fix yetMedium 6.5Aug 21, 2024Arbitrary file write in nats-server in github.com/nats-io/nats-serverCVE-2022-26652no fix yetHigh 8.8Aug 21, 2024Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-serverCVE-2022-24450no fix yetUnscoredJun 5, 2024NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-serverCVE-2021-32026no fix yetCritical 9.8Sep 19, 2023NATS nats-server allows directory traversal via unintended path to a management actionCVE-2022-28357fixed in 2.7.4