NATS-Server MQTT Password Exposure Vulnerability

A vulnerability in NATS-Server's MQTT implementation prior to versions 2.11.15 and 2.12.6 allows for the incorrect classification of MQTT passwords as non-authenticating identity statements. This misclassification leads to the exposure of these passwords through monitoring endpoints. The issue arises in MQTT deployments that utilize user codes and passwords.

Impact

The vulnerability allows for MQTT passwords to be exposed via monitoring endpoints, potentially leading to unauthorized access or actions under the user's identity.

Remediation

Users can upgrade to NATS-Server versions 2.12.6 or 2.11.15 to address this vulnerability. It is also recommended to secure monitoring endpoints and avoid exposing them to the Internet or untrusted networks.