The vulnerability in NATS‑Server allows an attacker to read MQTT passwords in clear text. Passwords are mistakenly exposed as non‑authenticating identity statements and can be retrieved through monitoring endpoints. This flaw can compromise user credentials, leading to unauthorized access to MQTT topics and possible downstream systems, thereby violating confidentiality.

Affected by the NATS.io community in the nats‑io:nats‑server product. Versions prior to 2.11.15 of the 2.11.x series and prior to 2.12.6 of the 2.12.x series are impacted. The fix is incorporated starting at 2.11.15 and 2.12.6.

The CVSS score of 8.6 indicates a high severity, while the EPSS value of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but it remains a significant risk if monitoring endpoints are reachable. Attackers gain read access through the monitoring API when it is improperly exposed, and the exploit path requires network connectivity to that endpoint. Once compromised, an attacker can obtain stored passwords for MQTT users.