xkeys Seal encryption used fixed key for all encryption

CVE	CVE-2023-46129
State	PUBLISHED
Assigner	GitHub_M
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-10-31 00:15:09 UTC
Updated	2026-03-30 14:30:00 UTC
Description	NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem Types: CWE-321 | CWE-325 | CWE-321 CWE-321: Use of Hard-coded Cryptographic Key | CWE-325 CWE-325: Missing Cryptographic Step

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
3.1	[email protected]	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
3.1	CNA	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type	Vendor	Product	Version	Update	Edition	Language
Application	Linuxfoundation	Nats-server	All	All	All	All
Application	Nats	Nkeys	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Nats-io	Nkeys	affected >= 2.10.0, < 2.10.4	Not specified
CNA	Nats-io	Nkeys	affected >= 0.4.0, < 0.4.6	Not specified

Reference	Source	Link	Tags
lists.fedoraproject.org/archives/list/[email protected]/messag...	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
oss-security - NATS: 2023-02: nkeys: xkeys Seal encryption used fixed key for all encryption	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List, Third Party Advisory
xkeys Seal encryption used fixed key for all encryption · Advisory · nats-io/nkeys · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Vendor Advisory
lists.fedoraproject.org/archives/list/[email protected]/messag...	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

284776 Fedora Security Update for golang (FEDORA-2023-66966ae3d0)
285137 Fedora Security Update for golang (FEDORA-2023-3a895ff65c)
506120 Alpine Linux Security Update for nats-server
907623 Common Base Linux Mariner (CBL-Mariner) Security Update for telegraf (31792-1)
995792 GO (Go) Security Update for github.com/nats-io/nats-server/v2 (GHSA-mr45-rx8q-wcm9)