| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/nats-io/nats-server | all versions | |
| github.com/nats-io/nats-server/v2 | ≥ 2.12.0-RC.1, < 2.12.6< 2.11.15 | 2.12.62.11.15 |
| nats-server | ≥ 2.12.0, < 2.12.6< 2.11.15 | 2.12.62.11.15 |
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server provides an MQTT client interface.
When using ACLs on message subjects, these ACLs were not applied in the $MQTT.> namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects.
Any version before v2.12.6 or v2.11.15
None.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free