NATS-Server versions prior to 2.11.15 and 2.12.6 contain a vulnerability where static credentials passed via command-line arguments are exposed in plaintext through the /debug/vars endpoint on the monitoring port if it is enabled. This endpoint reveals an unredacted copy of the command-line arguments, allowing an attacker with network access to the monitoring port to obtain sensitive authentication credentials. The issue is classified under CWE-215 (Insertion of Sensitive Information Into Debugging Code) and CWE-214 (Information Exposure Through Debug Information). The vulnerability has a CVSS v3.1 base score of 7.4 (high severity) with network attack vector, low attack complexity, no privileges required, and high confidentiality impact. The vendor has released fixed versions 2.11.15 and 2.12.6 that address this issue. Workarounds include avoiding passing credentials via argv and disabling the monitoring port if credentials are passed this way. The vendor advisory notes that mitigation options are limited and recommends upgrading to fixed versions.

An attacker with network access to the monitoring port can retrieve sensitive static credentials passed via command-line arguments, leading to a high confidentiality impact. This exposure can compromise authentication security for the nats-server instance. There is no impact on integrity or availability reported. No known exploits in the wild have been reported.

A fix is available in nats-server versions 2.11.15 and 2.12.6. Users should upgrade to these or later versions to remediate the vulnerability. As a workaround, avoid passing static credentials via command-line arguments and instead configure them in a configuration file. Additionally, do not enable the monitoring port if credentials are passed via argv. Restrict access to the monitoring port to trusted network sources only. The vendor advisory indicates that mitigation options other than upgrading may not meet criteria for ease of use or stability.