CVE-2020-26892Critical· 9.8▾ MidnightIncorrect handling of credential expiry by /nats-io/nats-server
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.1%
NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled.
The NATS accounts system has expiration timestamps on credentials; the https://github.com/nats-io/jwt library had an API which encouraged misuse and an IsRevoked() method which misused its own API.
A new IsClaimRevoked() method has correct handling and the nats-server has been updated to use this. The old IsRevoked() method now always returns true and other client code will have to be updated to avoid calling it.
The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications.
Time-based credential expiry did not work.
Have credentials which only expire after fixes can be deployed.
Upgrade the JWT dependency in any application using it.
Upgrade the NATS server if using NATS Accounts.
github.com/nats-io/jwt < 1.1.0Upgrade to a patched release:
github.com/nats-io/jwt 1.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3127Criticalnats-io/jwt not enforcing checking of Import token permissions
CVE-2026-33246Medium· 6.4NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
CVE-2026-33248Medium· 4.2NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
CVE-2023-47090HighNATS.io: Adding accounts for just the system account adds auth bypass
CVE-2022-26652Medium· 6.5Arbitrary file write in nats-server
CVE-2020-28466High· 7.5Denial of service in github.com/nats-io/nats-server/server