Executive brief
Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server
Affected products
- Go github.com/nats-io/nats-server/v2
- Go github.com/nats-io/nats-streaming-server
- Go github.com/nats-io/nats-server
Junglewise Threat Intelligence
CVE-2022-24450: GO-2022-0307 - Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server
CVE-2022-24450 · Severity: low · CVSS 3.1 · Published 2024-08-21
Technologies: github.com/nats-io/nats-server/v2 (Go), github.com/nats-io/nats-streaming-server (Go), github.com/nats-io/nats-server (Go). Vendors: Go.
Related threats
- GO-2026-4833 - NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server
- GO-2026-4835 - NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server
- GO-2026-4830 - NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server
- GO-2026-4832 - NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server
- GO-2026-4828 - NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server