CVE-2022-29946

What it actually does

The vulnerability stems from incomplete enforcement of negative permissions on queue subscriptions using wildcards, allowing a user to receive messages on subjects they were explicitly denied.

Why it matters to the business

Attackers with limited messaging access can read or interact with restricted data flows, potentially exposing sensitive operational information or enabling unauthorized control actions in connected systems.

How an attack unfolds

An authenticated user creates a queue subscription against a broad wildcard subject that overlaps with explicitly denied subjects; the server fails to apply the negative permission check in this scenario and delivers messages the user should not receive.

How to fix it

Upgrade NATS Server to version 2.8.2 or later and NATS Streaming Server to version 0.24.6 or later. Review and test all negative permission rules after the upgrade.

How to confirm the fix worked

Confirm the server reports version 2.8.2+ (or 0.24.6+ for streaming) and test that queue subscriptions on wildcards no longer deliver messages from explicitly denied subjects.

Typical attack path

1. Obtain valid low-privilege credentials for the NATS cluster
2. Issue a queue subscription using a wildcard that matches denied subjects
3. Receive messages containing data from the restricted subjects
4. Use the obtained information to advance further attacks or exfiltrate data

How to detect it

Review NATS server logs for queue subscription requests using wildcards that overlap with subjects covered by negative permissions; correlate with authentication events for the creating user.

What your security team should do

• Prioritize upgrade of all NATS Server and Streaming Server instances to the fixed releases
• Audit existing permission configurations for negative rules and wildcard subscriptions
• Monitor subscription creation logs for unexpected wildcard patterns