CyberRota Analysis
AI-GeneratedAuthenticated MQTT clients in NATS Server versions prior to 2.14.3 and 2.12.12 can exploit a permissions bypass vulnerability to subscribe to the internal $MQTT.deliver.pubrel subject family, potentially exposing sensitive QoS2 protocol metadata. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate the risk of unauthorized access to session data. This vulnerability is particularly relevant for environments leveraging NATS for messaging in cloud and edge applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)