NATS-Server Message Tracing Vulnerability Allows Unauthorized Subject Redirection

A vulnerability in NATS-Server versions 2.11.0 prior to 2.11.15 and 2.12.0 prior to 2.12.6 allows clients using message tracing headers to redirect trace messages to arbitrary subjects, including those the client is not authorized to publish to. The issue arises because the payload, while a valid trace message, is not selected by the client. This vulnerability could lead to unauthorized message delivery on the NATS messaging system.

Impact

Exploitation of this vulnerability could result in unauthorized message tracing redirection, allowing trace messages to be sent to subjects without proper publish permissions.

Remediation

Users can upgrade to NATS-Server versions 2.11.15 or 2.12.6 to address this vulnerability.