StackRadar

CVE-2023-47090

High

Advisory

Published 19 Oct 2023In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
28
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

NATS.io: Adding accounts for just the system account adds auth bypass

Carried by container images the latest versions of 28 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
github.com/nats-io/nats-server/v2golangv2.2.5, v2.2.6, v2.3.3, v2.7.4+9 more2.9.2321
OSV records
GHSA-fr2g-9hjm-wr23
Also known as
GO-2023-2133

Charts affected

28 by stars
ChartLatestAffected imagesRadar Score
openebsopenebsOfficialVerified publisher4.6.11 of 35See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/prometheus-nats-exporter:0.11.031c02aac089a
github.com/nats-io/nats-server/v2@v2.9.16
2.9.23

Open the chart page →

23,894
revadcs3orgOfficialVerified publisher1.6.11 of 1See more

revad cs3org 1.6.1

1 of the 1 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
cs3org/revad:v1.24.0e80a4d67b352
github.com/nats-io/nats-server/v2@v2.9.11
2.9.23

Open the chart page →

1,704
featurehubfeaturehub4.1.61 of 7See more

featurehub featurehub 4.1.6

1 of the 7 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.1a67913df95f1
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23

Open the chart page →

8,240
nats-account-servernatsVerified publisher0.8.11 of 1See more

nats-account-server nats 0.8.1

1 of the 1 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-account-server:1.0.0a3381560aab6
github.com/nats-io/nats-server/v2@v2.3.3
2.9.23

Open the chart page →

2,634
scienceboxsciencebox0.0.71 of 17See more

sciencebox sciencebox 0.0.7

1 of the 17 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
cs3org/revad:v1.19.03b57a34a7dfd
github.com/nats-io/nats-server/v2@v2.8.4
2.9.23

Open the chart page →

6,587
iopsciencemeshVerified publisher0.4.01 of 2See more

iop sciencemesh 0.4.0

1 of the 2 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
cs3org/revad:v1.24.0e80a4d67b352
github.com/nats-io/nats-server/v2@v2.9.11
2.9.23

Open the chart page →

4,052
ct-singlecalltelemetry0.8.42 of 7See more

ct-single calltelemetry 0.8.4

2 of the 7 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.11.09fbf7bf684e4
github.com/nats-io/nats-server/v2@v2.7.5-0.20220418055348-79b4374d01d8
2.9.23
natsio/prometheus-nats-exporter:0.10.016048afb67a5
github.com/nats-io/nats-server/v2@v2.8.4
2.9.23

Open the chart page →

10,629
stablecalltelemetry0.7.12 of 9See more

stable calltelemetry 0.7.1

2 of the 9 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.11.09fbf7bf684e4
github.com/nats-io/nats-server/v2@v2.7.5-0.20220418055348-79b4374d01d8
2.9.23
natsio/prometheus-nats-exporter:0.10.016048afb67a5
github.com/nats-io/nats-server/v2@v2.8.4
2.9.23

Open the chart page →

7,702
stable-hacalltelemetry0.11.41 of 7See more

stable-ha calltelemetry 0.11.4

1 of the 7 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.2e808e0644ce1
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23

Open the chart page →

4,705
stigatroncarbide-charts0.4.11 of 10See more

stigatron carbide-charts 0.4.1

1 of the 10 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.1a67913df95f1
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23

Open the chart page →

4,423
devtron-enterprisedevtron48.0.02 of 28See more

devtron-enterprise devtron 48.0.0

2 of the 28 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
quay.io/devtron/nats-box:latest48cdd3054b20
github.com/nats-io/nats-server/v2@v2.9.2
2.9.23
quay.io/devtron/prometheus-nats-exporter:0.9.094044746cbce
github.com/nats-io/nats-server/v2@v2.2.5
2.9.23

Open the chart page →

68,240
devtron-enterprisedevtron-labs48.0.02 of 28See more

devtron-enterprise devtron-labs 48.0.0

2 of the 28 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
quay.io/devtron/nats-box:latest48cdd3054b20
github.com/nats-io/nats-server/v2@v2.9.2
2.9.23
quay.io/devtron/prometheus-nats-exporter:0.9.094044746cbce
github.com/nats-io/nats-server/v2@v2.2.5
2.9.23

Open the chart page →

68,240
openfaas2eclipse-aeriosVerified publisher12.0.51 of 6See more

openfaas2 eclipse-aerios 12.0.5

1 of the 6 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
library/nats-streaming:0.25.5ced93c701875
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23

Open the chart page →

6,678
kube-ecp-stackemqx-operator2.5.11 of 16See more

kube-ecp-stack emqx-operator 2.5.1

1 of the 16 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
library/telegraf:1.27507a3eecf809
github.com/nats-io/nats-server/v2@v2.9.9
2.9.23

Open the chart page →

23,685
dendritegeek-cookbookVerified publisher6.4.01 of 1See more

dendrite geek-cookbook 6.4.0

1 of the 1 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
ghcr.io/matrix-org/dendrite-monolith:v0.9.43267d27d392f
github.com/nats-io/nats-server/v2@v2.8.5-0.20220811224153-d8d25d9b0b1c
2.9.23

Open the chart page →

2,143
kloudlite-platformkloudlite1.1.51 of 3See more

kloudlite-platform kloudlite 1.1.5

1 of the 3 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.1a67913df95f1
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23

Open the chart page →

1,970
telegraf-dslsst-sqre1.0.231 of 1See more

telegraf-ds lsst-sqre 1.0.23

1 of the 1 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
library/telegraf:1.19-alpineaddb86c0c520
github.com/nats-io/nats-server/v2@v2.2.6
2.9.23

Open the chart page →

3,764
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.31cc420186664
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23

Open the chart page →

24,400
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/prometheus-nats-exporter:0.11.031c02aac089a
github.com/nats-io/nats-server/v2@v2.9.16
2.9.23

Open the chart page →

21,064
nutanix-flow-cninutanix-helm-releasesVerified publisher1.1.01 of 7See more

nutanix-flow-cni nutanix-helm-releases 1.1.0

1 of the 7 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.1a67913df95f1
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23

Open the chart page →

4,988
one-green-coreone-green-coreVerified publisher0.0.71 of 8See more

one-green-core one-green-core 0.0.7

1 of the 8 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
library/telegraf:1.20.428e98eece020
github.com/nats-io/nats-server/v2@v2.2.6
2.9.23

Open the chart page →

9,558
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
quay.io/devtron/nats-box:latest48cdd3054b20
github.com/nats-io/nats-server/v2@v2.9.2
2.9.23
quay.io/devtron/prometheus-nats-exporter:0.9.094044746cbce
github.com/nats-io/nats-server/v2@v2.2.5
2.9.23

Open the chart page →

68,240
cernboxsciencebox0.0.41 of 6See more

cernbox sciencebox 0.0.4

1 of the 6 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
cs3org/revad:v1.19.03b57a34a7dfd
github.com/nats-io/nats-server/v2@v2.8.4
2.9.23

Open the chart page →

2,330
serviceexampleserviceexample0.1.01 of 5See more

serviceexample serviceexample 0.1.0

1 of the 5 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.13.559cf2e949181
github.com/nats-io/nats-server/v2@v2.9.2
2.9.23

Open the chart page →

5,449
service-exampleservice-example-10.1.02 of 7See more

service-example service-example-1 0.1.0

2 of the 7 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.13.3c507bd7e3831
github.com/nats-io/nats-server/v2@v2.9.6
2.9.23
natsio/prometheus-nats-exporter:0.10.1bce728062c4f
github.com/nats-io/nats-server/v2@v2.8.4
2.9.23

Open the chart page →

9,022
synadia-serversynadiaVerified publisher1.1.101 of 2See more

synadia-server synadia 1.1.10

1 of the 2 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.1a67913df95f1
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23

Open the chart page →

1,970
posteetrivy-operator2.14.02 of 3See more

postee trivy-operator 2.14.0

2 of the 3 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
aquasec/postee:2.12.0-amd640795cba777e7
github.com/nats-io/nats-server/v2@v2.7.4
2.9.23
aquasec/postee-ui:2.12.0-amd64c0467c3941dc
github.com/nats-io/nats-server/v2@v2.7.4
2.9.23

Open the chart page →

4,815
nats-account-serverwenerme0.8.11 of 1See more

nats-account-server wenerme 0.8.1

1 of the 1 container images this version deploys carry CVE-2023-47090.

Container imageDigestPackageFixed in
natsio/nats-account-server:1.0.0a3381560aab6
github.com/nats-io/nats-server/v2@v2.3.3
2.9.23

Open the chart page →

2,634

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
natsio/nats-box:0.14.1a67913df95f1
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23
5
quay.io/devtron/nats-box:latest48cdd3054b20
github.com/nats-io/nats-server/v2@v2.9.2
2.9.23
3
quay.io/devtron/prometheus-nats-exporter:0.9.094044746cbce
github.com/nats-io/nats-server/v2@v2.2.5
2.9.23
3
cs3org/revad:v1.19.03b57a34a7dfd
github.com/nats-io/nats-server/v2@v2.8.4
2.9.23
2
cs3org/revad:v1.24.0e80a4d67b352
github.com/nats-io/nats-server/v2@v2.9.11
2.9.23
2
natsio/nats-account-server:1.0.0a3381560aab6
github.com/nats-io/nats-server/v2@v2.3.3
2.9.23
2
natsio/nats-box:0.11.09fbf7bf684e4
github.com/nats-io/nats-server/v2@v2.7.5-0.20220418055348-79b4374d01d8
2.9.23
2
natsio/prometheus-nats-exporter:0.10.016048afb67a5
github.com/nats-io/nats-server/v2@v2.8.4
2.9.23
2
natsio/prometheus-nats-exporter:0.11.031c02aac089a
github.com/nats-io/nats-server/v2@v2.9.16
2.9.23
2
aquasec/postee:2.12.0-amd640795cba777e7
github.com/nats-io/nats-server/v2@v2.7.4
2.9.23
1
aquasec/postee-ui:2.12.0-amd64c0467c3941dc
github.com/nats-io/nats-server/v2@v2.7.4
2.9.23
1
library/nats-streaming:0.25.5ced93c701875
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23
1
library/telegraf:1.20.428e98eece020
github.com/nats-io/nats-server/v2@v2.2.6
2.9.23
1
library/telegraf:1.27507a3eecf809
github.com/nats-io/nats-server/v2@v2.9.9
2.9.23
1
library/telegraf:1.19-alpineaddb86c0c520
github.com/nats-io/nats-server/v2@v2.2.6
2.9.23
1
natsio/nats-box:0.14.31cc420186664
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23
1
natsio/nats-box:0.13.559cf2e949181
github.com/nats-io/nats-server/v2@v2.9.2
2.9.23
1
natsio/nats-box:0.13.3c507bd7e3831
github.com/nats-io/nats-server/v2@v2.9.6
2.9.23
1
natsio/nats-box:0.14.2e808e0644ce1
github.com/nats-io/nats-server/v2@v2.9.19
2.9.23
1
natsio/prometheus-nats-exporter:0.10.1bce728062c4f
github.com/nats-io/nats-server/v2@v2.8.4
2.9.23
1
ghcr.io/matrix-org/dendrite-monolith:v0.9.43267d27d392f
github.com/nats-io/nats-server/v2@v2.8.5-0.20220811224153-d8d25d9b0b1c
2.9.23
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.