{"action":"Upgrade github.com/nats-io/nats-server/v2 to 2.9.23 or later.","affected":[{"fixed":"2.9.23","introduced":"2.2.0"},{"fixed":"2.10.2","introduced":"2.10.0"}],"component":"github.com/nats-io/nats-server/v2","cve_ids":["CVE-2023-47090"],"ecosystem":"Go","epss":0.00662,"exploited":false,"fixed_versions":["2.9.23","2.10.2"],"ghsa_id":"GHSA-fr2g-9hjm-wr23","id":"tcs_01M5KF9R4CA079B6FV3KS7QRKY","modified_at":"2026-09-10T03:50:03.627050215Z","published_at":"2023-10-19T16:13:03Z","references":["https://osv.dev/vulnerability/GHSA-fr2g-9hjm-wr23","https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23","https://github.com/nats-io/nats-server/pull/4605","https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478","https://advisories.nats.io/CVE/secnote-2023-01.txt","https://github.com/nats-io/nats-server","https://github.com/nats-io/nats-server/discussions/4535","https://github.com/nats-io/nats-server/releases/tag/v2.10.2","https://github.com/nats-io/nats-server/releases/tag/v2.9.23"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-fr2g-9hjm-wr23","url":"https://osv.dev/vulnerability/GHSA-fr2g-9hjm-wr23"}],"summary":"NATS.io: Adding accounts for just the system account adds auth bypass"}