CVE-2023-46129

What it actually does

The nkeys library's xkeys encryption logic passes an array by value into an internal function that mutates the buffer, causing all encryption operations to use an all-zeros key instead of the generated key material; signing remains unaffected.

Why it matters to the business

Encrypted authentication callouts and pub-sub messages between components can be decrypted by any observer, exposing credentials, tokens, or sensitive payloads and undermining confidentiality controls in distributed messaging setups.

How an attack unfolds

An attacker positioned to observe or intercept traffic between a NATS server performing auth callouts and its clients captures the ciphertext produced by the flawed xkeys implementation; because the effective key is all zeros, the attacker can trivially decrypt the data to obtain authentication material or message contents without needing the real key.

How to fix it

Upgrade the nkeys dependency to version 0.4.6 or later (corresponding to NATS Server 2.10.4) and rebuild/deploy affected applications; for the zitadel/zitadel package apply commit 762b19da06b24cae4a1a5ec73d4e3a919e4454a2.

How to confirm the fix worked

Verify the nkeys Go module version in go.mod or the compiled binary, confirm the NATS server reports version 2.10.4 or newer, and test that encryption callouts no longer produce all-zeros encrypted payloads.

Typical attack path

1. Identify NATS deployments using nkeys versions 0.4.0-0.4.5 for auth callouts
2. Position to intercept encrypted callout traffic or stored messages
3. Capture ciphertext produced by the xkeys encryption path
4. Decrypt using the known all-zeros key to recover plaintext authentication data or messages

How to detect it

Search application and NATS server logs for auth callout events occurring while running nkeys 0.4.0-0.4.5; inspect network captures or message stores for encrypted payloads that decrypt successfully under an all-zeros key.

What your security team should do

• Immediately update zitadel/zitadel to the commit containing the nkeys fix and redeploy
• Audit all Go applications using nkeys 0.4.0-0.4.5 for encryption usage and schedule upgrades
• Review auth callout logs and traffic for any historical exposure of sensitive material
• Add dependency scanning to CI pipelines to catch future cryptographic library regressions