VDB

GHSA-x6g4-f6q3-fqvv

GHSA-x6g4-f6q3-fqvv PUBLISHED CVSS 7.400000095367432 HIGH

NATS credentials are exposed in monitoring port via command-line argv

Record from GitHub Advisory Database · Published March 24, 2026

NATS credentials are exposed in monitoring port via command-line argv

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
milvus-2.5Chainguard2.5.27-r4
nats-topChainguard0.6.3-r18
natsChainguard0.3.2-r0
prometheus-nats-exporterWolfi0.19.1-r4
k3s-1.32Wolfi1.32.13.1-r7
k3s-1.32Chainguard1.32.13.1-r7
telegraf-1.38Wolfi1.38.1-r1
telegraf-1.38Chainguard1.38.1-r1
k3s-1.33Wolfi1.33.9.1-r6
rke2-runtime-1.33Chainguard1.33.9.2.1-r3

Risk scores

CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

VendorProductVersions
chainguardmilvus-2.50
chainguardnats-top0
chainguardnats0
wolfiprometheus-nats-exporter0
wolfik3s-1.320
chainguardk3s-1.320
wolfitelegraf-1.380
chainguardtelegraf-1.380
wolfik3s-1.330
chainguardrke2-runtime-1.330
github.comnats-io/nats-server/v22.12.6, 0, 2.12.0-RC.1
wolfikine0
chainguardrke2-runtime-1.350
chainguardnats-top-fips0
wolfitelegraf-1.370
chainguardtelegraf-1.370
wolfinats0
chainguardrke2-runtime-fips-1.350
chainguardprometheus-nats-exporter0
wolfik3s0

…and 9 more

Timeline

  • Mar 24, 2026 CVE Published
  • Mar 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-x6g4-f6q3-fqvv
vulnetix vdb fixes GHSA-x6g4-f6q3-fqvv

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-x6g4-f6q3-fqvv/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›