NATS-Server versions prior to 2.11.15 and 2.12.6 contain a vulnerability where static client credentials passed as command-line arguments are exposed via the /debug/vars endpoint on the monitoring port if it is enabled. This endpoint reveals an unredacted copy of argv, leading to disclosure of sensitive authentication information. The issue is categorized under CWE-215 (Insertion of Sensitive Information Into Debugging Code) and CWE-214 (Information Exposure Through Debug Log Files). The vulnerability has a CVSS v3.1 base score of 7.4 (high severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor advisory confirms a fix is available in versions 2.11.15 and 2.12.6. Workarounds include avoiding passing credentials via argv and disabling the monitoring port if secrets are passed this way. The monitoring port should not be exposed to untrusted networks.

An attacker with network access to the monitoring port can obtain sensitive static client credentials by accessing the /debug/vars endpoint, leading to a confidentiality breach of authentication secrets. This could allow unauthorized access to the messaging system if the credentials are reused or provide further attack opportunities. The vulnerability does not impact integrity or availability directly.

A fix is available in nats-server versions 2.11.15 and 2.12.6; upgrading to these or later versions is recommended. As a workaround, do not pass static credentials via command-line arguments; instead, configure them in a configuration file. Additionally, do not enable the monitoring port if credentials are passed via argv. Ensure the monitoring port is not exposed to untrusted or public networks to prevent unauthorized access. Follow vendor guidance and apply official patches when possible.