The vulnerability arises when nats-server is started with static credentials supplied as command‑line arguments. The monitoring port’s /debug/vars endpoint returns an unredacted copy of those arguments, allowing any user with network access to the monitoring port to view the credentials. Thus an attacker can obtain the usernames and passwords required to connect as a client to the NATS server, leading to unauthorized access and potential compromise of the messaging system.

Vendor nats-io’s nats-server product is affected. Versions prior to 2.11.15 and 2.12.6 contain the flaw. The security patch was introduced in nats-server 2.11.15 and 2.12.6, so any deployment running an earlier release must be updated. The issue is tied to the monitoring port feature; systems that expose this port to untrusted networks are at higher risk.

CVSS score 7.4 indicates high severity. The EPSS score is <1 %, suggesting a low probability of exploitation that may be opportunistic. The vulnerability is not listed in the CISA KEV catalog. Externally, the flaw can be exploited by anybody who can reach the monitoring port, such as a remote attacker who has network connectivity to the NATS server. Internally, local users with access to the same machine may also harvest credentials. Once obtained, the attacker can impersonate legitimate clients and potentially intercept or inject messages.