A critical vulnerability in NATS-Server allows unauthenticated attackers to potentially exfiltrate MQTT passwords via exposed monitoring endpoints.

The application incorrectly classifies MQTT passwords as non-authenticating identity statements, resulting in the exposure of credentials through monitoring endpoints. This flaw is exploitable by an unauthenticated attacker with network access to the monitoring interface.

The exposure of MQTT credentials poses a severe risk to organizational data confidentiality and messaging integrity. Given the CVSS score of 8.6, this vulnerability facilitates unauthorized access to sensitive messaging traffic, potentially leading to widespread information disclosure or system compromise.

Immediate Action: Update NATS-Server instances to version 2.11.15 or 2.12.6 immediately to resolve the credential exposure flaw.

Proactive Monitoring: Review access logs for the monitoring endpoint to identify any unauthorized requests or anomalous traffic patterns that may indicate reconnaissance or exploitation.

Compensating Controls: Ensure that monitoring endpoints are not exposed to the public Internet or untrusted network segments, and implement strict network-level access controls to limit interaction with these interfaces.

Public Exploit Available: exploit_available (unknown)

Organizations utilizing NATS-Server for MQTT deployments must prioritize the application of the provided security patches. If an immediate update is not feasible, restricting access to monitoring endpoints is a mandatory mitigation step to prevent unauthorized credential harvesting.