NATS-Server versions prior to 2.11.15 and 2.12.6 contain a vulnerability where MQTT passwords are incorrectly treated as non-authenticating identity statements (JWT). This misclassification causes the passwords to be exposed through monitoring endpoints, which can be accessed by attackers with network access to these endpoints. The vulnerability is identified as CWE-256 (Plaintext Storage of a Password) and CWE-213 (Information Exposure Through Discrepant Handling). The issue is fixed in versions 2.11.15 and 2.12.6. The vulnerability has a CVSS v3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating network attack vector, low complexity, no privileges or user interaction required, changed scope, and high confidentiality impact without integrity or availability impact. No known exploits in the wild have been reported. The vendor advisory notes that mitigation options other than upgrading do not meet criteria for ease of use and applicability, but recommends securing monitoring endpoints as a workaround.

An attacker with network access to the monitoring endpoints can obtain MQTT passwords due to their exposure in plaintext. This compromises confidentiality but does not affect integrity or availability of the system. The vulnerability allows unauthorized disclosure of sensitive authentication credentials, which could lead to further unauthorized access if exploited.

A fix is available in nats-server versions 2.11.15 and 2.12.6. Users should upgrade to these or later versions to remediate the vulnerability. As a workaround, ensure that monitoring endpoints are adequately secured and not exposed to untrusted networks or the Internet. The vendor advisory indicates that other mitigations do not meet criteria for broad applicability or stability.