CVE-2022-24450: Linuxfoundation Nats-Server

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.

Affected products

• Linuxfoundation Nats-Server: from 2.0.0, before 2.7.2 (fixed in 2.7.2)
• Nats Nats Streaming Server: from 0.15.0, before 0.24.1 (fixed in 0.24.1)

Published 2022-02-08. Last modified 2026-06-17.