CVE-2022-29946

Medium

Advisory

Published 11 Jul 2024In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 29; of 17,781 indexed, latest versions
Container images: 21; deployed by those charts
Fix available: 2 of 2; affected packages

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects

Carried by container images the latest versions of 29 of 17,781 indexed charts deploy, on 21 images.

Affected package	Affected versions	Fixed in	Images
github.com/nats-io/nats-server/v2golang	v0.0.0-20230518181934-4f2c9a51849d, v0.0.0-20230713200038-97dd7cb07a4f, v0.0.0-20231109212332-0883d32bbcc5, v0.0.0-20231206205519-fa8464d59b0a+12 more	2.8.2	18
github.com/nats-io/nats-streaming-servergolang	v0.0.0-20230620214220-abfd5a300f4c, v0.0.0-20231117220321-d1a98ca97b37, v0.22.0	0.24.6	3

OSV records: GHSA-2h2x-8hh2-mfq8
Also known as: GO-2024-2980

Charts affected

29 by stars

Chart

Latest

Affected images

Radar Score

openebsopenebs

4.6.1

1 of 35 See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.9.17-alpine	1a7b320b2942	github.com/nats-io/nats-server/v2@v0.0.0-20230518181934-4f2c9a51849d	2.8.2

Open the chart page →

23,894

openfaasopenfaas

15.0.13

1 of 6 See more

openfaas openfaas 15.0.13

1 of the 6 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats-streaming :0.25.6	0ad6861379c9	github.com/nats-io/nats-streaming-server@v0.0.0-20231117220321-d1a98ca97b37	0.24.6

Open the chart page →

3,543

nginx-service-meshnginx

2.0.0

1 of 9 See more

nginx-service-mesh nginx 2.0.0

1 of the 9 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.9-alpine	d402af4147fc	github.com/nats-io/nats-server/v2@v0.0.0-20240301171717-567baac9e011	2.8.2

Open the chart page →

1,166

wasmcloud-chartwasmcloud-chart

0.7.2

1 of 2 See more

wasmcloud-chart wasmcloud-chart 0.7.2

1 of the 2 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10.7-alpine	1bcddab51b80	github.com/nats-io/nats-server/v2@v0.0.0-20231206205519-fa8464d59b0a	2.8.2

Open the chart page →

3,456

featurehubfeaturehub

4.1.6

1 of 7 See more

featurehub featurehub 4.1.6

1 of the 7 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10.5-alpine	85319e5e541b	github.com/nats-io/nats-server/v2@v0.0.0-20231109212332-0883d32bbcc5	2.8.2

Open the chart page →

8,240

fission-corefission-charts

1.14.1

1 of 3 See more

fission-core fission-charts 1.14.1

1 of the 3 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
fission/fission-bundle :1.14.1	3fcfd8a0fa5d	github.com/nats-io/nats-streaming-server@v0.22.0	0.24.6

Open the chart page →

7,104

nats-account-servernats

0.8.1

1 of 1 See more

nats-account-server nats 0.8.1

1 of the 1 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
natsio/nats-account-server :1.0.0	a3381560aab6	github.com/nats-io/nats-server/v2@v2.3.3	2.8.2

Open the chart page →

2,634

octopuso7studios-octopus-helm-charts

1.2.3

1 of 5 See more

octopus o7studios-octopus-helm-charts 1.2.3

1 of the 5 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.11.9-alpine	777787bbb4c7	github.com/nats-io/nats-server/v2@v0.0.0-20250909150505-3c10f160f4d7	2.8.2

Open the chart page →

6,091

ct-singlecalltelemetry

0.8.4

1 of 7 See more

ct-single calltelemetry 0.8.4

1 of the 7 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
natsio/nats-box :0.11.0	9fbf7bf684e4	github.com/nats-io/nats-server/v2@v2.7.5-0.20220418055348-79b4374d01d8	2.8.2

Open the chart page →

10,629

stablecalltelemetry

0.7.1

1 of 9 See more

stable calltelemetry 0.7.1

1 of the 9 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
natsio/nats-box :0.11.0	9fbf7bf684e4	github.com/nats-io/nats-server/v2@v2.7.5-0.20220418055348-79b4374d01d8	2.8.2

Open the chart page →

7,702

stable-hacalltelemetry

0.11.4

1 of 7 See more

stable-ha calltelemetry 0.11.4

1 of the 7 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10.12-alpine	bca70839d953	github.com/nats-io/nats-server/v2@v0.0.0-20240312212138-121169ea8675	2.8.2

Open the chart page →

4,705

stigatroncarbide-charts

0.4.1

1 of 10 See more

stigatron carbide-charts 0.4.1

1 of the 10 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10.5-alpine	85319e5e541b	github.com/nats-io/nats-server/v2@v0.0.0-20231109212332-0883d32bbcc5	2.8.2

Open the chart page →

4,423

devtron-enterprisedevtron

48.0.0

1 of 28 See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
quay.io/devtron/prometheus-nats-exporter :0.9.0	94044746cbce	github.com/nats-io/nats-server/v2@v2.2.5	2.8.2

Open the chart page →

68,240

devtron-enterprisedevtron-labs

48.0.0

1 of 28 See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
quay.io/devtron/prometheus-nats-exporter :0.9.0	94044746cbce	github.com/nats-io/nats-server/v2@v2.2.5	2.8.2

Open the chart page →

68,240

llo-natseclipse-aerios

1.0.0

1 of 1 See more

llo-nats eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.11.4	c8cd23806eef	github.com/nats-io/nats-server/v2@v0.0.0-20250522132111-4c2fc7f07d97	2.8.2

Open the chart page →

837

openfaas2eclipse-aerios

12.0.5

1 of 6 See more

openfaas2 eclipse-aerios 12.0.5

1 of the 6 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats-streaming :0.25.5	ced93c701875	github.com/nats-io/nats-streaming-server@v0.0.0-20230620214220-abfd5a300f4c	0.24.6

Open the chart page →

6,678

telegraf-dslsst-sqre

1.0.23

1 of 1 See more

telegraf-ds lsst-sqre 1.0.23

1 of the 1 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/telegraf :1.19-alpine	addb86c0c520	github.com/nats-io/nats-server/v2@v2.2.6	2.8.2

Open the chart page →

3,764

magistralamagistrala-devops

0.16.2

1 of 42 See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10.17-alpine	b7752304692b	github.com/nats-io/nats-server/v2@v0.0.0-20240627223150-b91de0356018	2.8.2

Open the chart page →

24,400

mayastormayastor

2.12.1

1 of 31 See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.9.17-alpine	1a7b320b2942	github.com/nats-io/nats-server/v2@v0.0.0-20230518181934-4f2c9a51849d	2.8.2

Open the chart page →

21,064

nutanix-flow-cninutanix-helm-releases

1.1.0

1 of 7 See more

nutanix-flow-cni nutanix-helm-releases 1.1.0

1 of the 7 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10-alpine	b83efabe3e7d	github.com/nats-io/nats-server/v2@v0.0.0-20250501093519-f91ddd892565	2.8.2

Open the chart page →

4,988

one-green-coreone-green-core

0.0.7

1 of 8 See more

one-green-core one-green-core 0.0.7

1 of the 8 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/telegraf :1.20.4	28e98eece020	github.com/nats-io/nats-server/v2@v2.2.6	2.8.2

Open the chart page →

9,558

devtron-enterpriseromholdings

48.0.0

1 of 28 See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
quay.io/devtron/prometheus-nats-exporter :0.9.0	94044746cbce	github.com/nats-io/nats-server/v2@v2.2.5	2.8.2

Open the chart page →

68,240

serviceexampleserviceexample

0.1.0

1 of 5 See more

serviceexample serviceexample 0.1.0

1 of the 5 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.9.20-alpine	d6c6ae7df4a0	github.com/nats-io/nats-server/v2@v0.0.0-20230713200038-97dd7cb07a4f	2.8.2

Open the chart page →

5,449

avalanchesnowplow-devops

0.12.1

1 of 6 See more

avalanche snowplow-devops 0.12.1

1 of the 6 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10-alpine	b83efabe3e7d	github.com/nats-io/nats-server/v2@v0.0.0-20250501093519-f91ddd892565	2.8.2

Open the chart page →

1,329

telegraf-ds-k3stelegraf-ds-k3s

1.0.0

1 of 1 See more

telegraf-ds-k3s telegraf-ds-k3s 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/telegraf :1.19.0-alpine	794079a7f241	github.com/nats-io/nats-server/v2@v2.1.4	2.8.2

Open the chart page →

3,764

the0the0

0.9.8

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10-alpine	b83efabe3e7d	github.com/nats-io/nats-server/v2@v0.0.0-20250501093519-f91ddd892565	2.8.2

Open the chart page →

7,248

posteetrivy-operator

2.14.0

2 of 3 See more

postee trivy-operator 2.14.0

2 of the 3 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
aquasec/postee :2.12.0-amd64	0795cba777e7	github.com/nats-io/nats-server/v2@v2.7.4	2.8.2
aquasec/postee-ui :2.12.0-amd64	c0467c3941dc	github.com/nats-io/nats-server/v2@v2.7.4	2.8.2

Open the chart page →

4,815

tfy-distributortruefoundry

0.0.1

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
library/nats :2.10.7-alpine	1bcddab51b80	github.com/nats-io/nats-server/v2@v0.0.0-20231206205519-fa8464d59b0a	2.8.2

Open the chart page →

17,323

nats-account-serverwenerme

0.8.1

1 of 1 See more

nats-account-server wenerme 0.8.1

1 of the 1 container images this version deploys carry CVE-2022-29946.

Container image	Digest	Package	Fixed in
natsio/nats-account-server :1.0.0	a3381560aab6	github.com/nats-io/nats-server/v2@v2.3.3	2.8.2

Open the chart page →

2,634

Container images carrying it

21 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/nats :2.10-alpine	b83efabe3e7d	github.com/nats-io/nats-server/v2@v0.0.0-20250501093519-f91ddd892565	2.8.2	3
quay.io/devtron/prometheus-nats-exporter :0.9.0	94044746cbce	github.com/nats-io/nats-server/v2@v2.2.5	2.8.2	3
library/nats :2.9.17-alpine	1a7b320b2942	github.com/nats-io/nats-server/v2@v0.0.0-20230518181934-4f2c9a51849d	2.8.2	2
library/nats :2.10.7-alpine	1bcddab51b80	github.com/nats-io/nats-server/v2@v0.0.0-20231206205519-fa8464d59b0a	2.8.2	2
library/nats :2.10.5-alpine	85319e5e541b	github.com/nats-io/nats-server/v2@v0.0.0-20231109212332-0883d32bbcc5	2.8.2	2
natsio/nats-account-server :1.0.0	a3381560aab6	github.com/nats-io/nats-server/v2@v2.3.3	2.8.2	2
natsio/nats-box :0.11.0	9fbf7bf684e4	github.com/nats-io/nats-server/v2@v2.7.5-0.20220418055348-79b4374d01d8	2.8.2	2
aquasec/postee :2.12.0-amd64	0795cba777e7	github.com/nats-io/nats-server/v2@v2.7.4	2.8.2	1
aquasec/postee-ui :2.12.0-amd64	c0467c3941dc	github.com/nats-io/nats-server/v2@v2.7.4	2.8.2	1
fission/fission-bundle :1.14.1	3fcfd8a0fa5d	github.com/nats-io/nats-streaming-server@v0.22.0	0.24.6	1
library/nats :2.11.9-alpine	777787bbb4c7	github.com/nats-io/nats-server/v2@v0.0.0-20250909150505-3c10f160f4d7	2.8.2	1
library/nats :2.10.17-alpine	b7752304692b	github.com/nats-io/nats-server/v2@v0.0.0-20240627223150-b91de0356018	2.8.2	1
library/nats :2.10.12-alpine	bca70839d953	github.com/nats-io/nats-server/v2@v0.0.0-20240312212138-121169ea8675	2.8.2	1
library/nats :2.11.4	c8cd23806eef	github.com/nats-io/nats-server/v2@v0.0.0-20250522132111-4c2fc7f07d97	2.8.2	1
library/nats :2.9-alpine	d402af4147fc	github.com/nats-io/nats-server/v2@v0.0.0-20240301171717-567baac9e011	2.8.2	1
library/nats :2.9.20-alpine	d6c6ae7df4a0	github.com/nats-io/nats-server/v2@v0.0.0-20230713200038-97dd7cb07a4f	2.8.2	1
library/nats-streaming :0.25.6	0ad6861379c9	github.com/nats-io/nats-streaming-server@v0.0.0-20231117220321-d1a98ca97b37	0.24.6	1
library/nats-streaming :0.25.5	ced93c701875	github.com/nats-io/nats-streaming-server@v0.0.0-20230620214220-abfd5a300f4c	0.24.6	1
library/telegraf :1.20.4	28e98eece020	github.com/nats-io/nats-server/v2@v2.2.6	2.8.2	1
library/telegraf :1.19.0-alpine	794079a7f241	github.com/nats-io/nats-server/v2@v2.1.4	2.8.2	1
library/telegraf :1.19-alpine	addb86c0c520	github.com/nats-io/nats-server/v2@v2.2.6	2.8.2	1