CVE-2021-3127 in NATS Server
Summary
by MITRE • 03/17/2021
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/30/2026
The vulnerability identified as CVE-2021-3127 affects NATS Server versions 2.x prior to 2.2.0 and JWT library versions before 2.0.1, representing a critical access control flaw that undermines the security posture of messaging systems relying on these components. This issue stems from improper handling of import token bindings within the NATS authentication and authorization framework, creating potential pathways for unauthorized access to protected resources and services.
The technical root cause of this vulnerability lies in the incorrect implementation of access control mechanisms when processing import token bindings within the NATS server architecture. Import tokens in NATS are used to grant specific permissions to clients for accessing particular subjects or services within the message broker. When these tokens are mishandled during the import process, the server fails to properly validate or enforce the access restrictions defined by the token bindings. This flaw allows malicious actors to potentially bypass intended access controls and gain unauthorized access to resources that should be restricted based on the import token permissions.
The operational impact of this vulnerability extends across multiple security domains and can result in significant compromise of messaging system integrity. An attacker exploiting this vulnerability could potentially access sensitive message streams, intercept communications, or manipulate message flows within the NATS network. The vulnerability particularly affects systems where fine-grained access control is implemented through import tokens, making it especially dangerous in enterprise environments where message security and access control are paramount. The flaw could enable lateral movement within networks where NATS serves as a communication backbone, potentially leading to broader system compromise.
This vulnerability aligns with CWE-284, which addresses improper access control issues, and maps to ATT&CK technique T1078.004 for valid accounts and T1566.002 for spearphishing via social media, as the compromised access could enable further attack vectors. The misconfiguration of access controls in NATS server components creates a persistent security weakness that affects the overall security posture of organizations relying on these messaging services. Organizations using affected versions of NATS server and JWT library are at risk of unauthorized data access and potential message interception attacks.
The recommended mitigation strategy involves immediate upgrade to NATS Server version 2.2.0 or later and JWT library version 2.0.1 or newer, which contain the necessary patches to properly handle import token bindings. Additionally, organizations should conduct thorough security assessments of their NATS deployments to identify any potential exploitation attempts and implement monitoring solutions to detect anomalous access patterns. Security teams should also review and validate existing import token configurations to ensure proper access control enforcement, while considering implementing additional security controls such as network segmentation and enhanced logging to detect potential exploitation attempts.