CVE-2023-46129 in nkeys
Summary
by MITRE • 10/31/2023
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/30/2026
The vulnerability identified as CVE-2023-46129 affects the nkeys cryptographic library used within NATS.io messaging systems, specifically impacting the encryption functionality rather than signing operations. This issue resides in the nkeys library version 0.4.0 through 0.4.5, which corresponds to NATS server versions 2.10.0 through 2.10.3, creating a critical security flaw in authentication callout mechanisms that rely on encryption. The flaw manifests in the xkeys encryption handling logic where an array is mistakenly passed by value to an internal function that subsequently mutates the buffer to populate the encryption key. This critical error results in all encryption operations being performed using an all-zeros key, effectively rendering the encryption meaningless and providing no cryptographic protection for sensitive data. The vulnerability directly impacts NATS server authentication callouts that depend on the nkeys library for secure credential handling, potentially allowing attackers to intercept and decrypt communications that should remain protected. This represents a significant weakness in the security architecture of NATS.io deployments where encryption is expected to provide confidentiality assurances. The flaw demonstrates a classic buffer handling error where value passing semantics conflict with expected mutable operations, creating a security boundary failure that undermines the entire cryptographic implementation. Organizations using NATS server versions within the affected range face potential exposure of sensitive authentication data and communication payloads that were intended to be encrypted but remained vulnerable due to the ineffective encryption mechanism. The vulnerability affects the core security model of authentication callouts, which rely on proper key derivation and encryption to validate user credentials and secure communication channels. This issue falls under CWE-252, representing an improper check for a fixed buffer, and aligns with ATT&CK technique T1552.001 for unsecured credentials, as the all-zeros key effectively eliminates cryptographic protection for authentication data. The patch released in nkeys version 0.4.6 and corresponding NATS server 2.10.4 addresses this by correcting the buffer passing semantics to ensure proper key handling during encryption operations. Organizations must update their dependencies immediately, recompile affected applications, and redeploy in lockstep to prevent exploitation of this vulnerability. No viable workarounds exist for this specific issue, making the dependency update the only effective mitigation strategy. The flaw underscores the critical importance of proper memory management and buffer handling in cryptographic libraries, where even subtle implementation errors can completely compromise security assurances. This vulnerability demonstrates how cryptographic implementations must maintain strict integrity in key handling operations, as any deviation from expected behavior can result in catastrophic security failures that expose entire systems to unauthorized access and data compromise.