https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 09:34:35 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/euvd-2026-162218 EUVD-2026-162218 https://cve.radiocsirt.org/vuln/euvd-2026-162218 https://cve.radiocsirt.org/vuln/fkie_cve-2023-47090 <p>NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.</p> <p>NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-47090 https://cve.radiocsirt.org/vuln/ghsa-fr2g-9hjm-wr23 <p><strong>Affected:</strong> Go: github.com/nats-io/nats-server/v2</p> <p>## Background</p> <p>NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.</p> <p>NATS users exist within accounts, and once using accounts, the old authorization block is not applicable.</p> <p>## Problem Description</p> <p>Without any authorization rules in the nats-server, users can connect without authentication.</p> <p>Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an &#34;authorization&#34; block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, &#34;$G&#34;. Users inside accounts go into the newer &#34;accounts&#34; block.</p> <p>If an &#34;accounts&#34; block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account &#34;$SYS&#34;, the nats-server would create an implicit user in &#34;$G&#34; and set it as the `no_auth_user` account, enabling the same &#34;without authentication&#34; logic as without any rules.</p> <p>This preserved the ability to connect simply, and then add one authenticated login for system access.</p> <p>But with an &#34;authorization&#34; block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.</p> <p>The blind-spot on our part ca…</p> <p><strong>Affected:</strong> Go: github.com/nats-io/nats-server/v2</p> <p>## Background</p> <p>NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.</p> <p>NATS users exist within accounts, and once using accounts, the old authorization block is not applicable.</p> <p>## Problem Description</p> <p>Without any authorization rules in the nats-server, users can connect without authentication.</p> <p>Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an &#34;authorization&#34; block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, &#34;$G&#34;. Users inside accounts go into the newer &#34;accounts&#34; block.</p> <p>If an &#34;accounts&#34; block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account &#34;$SYS&#34;, the nats-server would create an implicit user in &#34;$G&#34; and set it as the `no_auth_user` account, enabling the same &#34;without authentication&#34; logic as without any rules.</p> <p>This preserved the ability to connect simply, and then add one authenticated login for system access.</p> <p>But with an &#34;authorization&#34; block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.</p> <p>The blind-spot on our part ca…</p> https://cve.radiocsirt.org/vuln/ghsa-fr2g-9hjm-wr23 https://cve.radiocsirt.org/vuln/gsd-2023-47090 gsd-2023-47090 https://cve.radiocsirt.org/vuln/gsd-2023-47090 https://cve.radiocsirt.org/vuln/msrc_cve-2023-47090 msrc_CVE-2023-47090 https://cve.radiocsirt.org/vuln/msrc_cve-2023-47090 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-47090 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: nats-server</p> <p>NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: nats-server</p> <p>NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-47090