CVE-2023-46129 xkeys Seal encryption used fixed key for all encryption

High 7.5 Published 30 Oct 2023 Updated 27 Feb 2025

The nkeys library used an all-zeros key for encryption, allowing attackers to bypass authentication callout security in NATS server deployments.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-46129?

CVE-2023-46129 is a high-severity vulnerability in nats-io nkeys, published on 30 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

Weakness: CWE-325, CWE-321

Which versions are affected by CVE-2023-46129?

6 open source packages ship an affected version, including github.com/nats-io/nkeys, nats and github.com/nats-io/nats-server/v2. It affects 2 products.

Package	Affected	Fixed in
`github.com/nats-io/nkeys` Go	From `0.4.0`	`0.4.6`
`github.com/nats-io/nkeys` Go	From `0.4.0`	`0.4.6`
`github.com/nats-io/nkeys` Go	From `0.4.0`	`0.4.6`
`nats` Bitnami	From `2.10.0`	`2.10.4`
`github.com/nats-io/nats-server/v2` Go	From `2.10.0`	`2.10.4`
`github.com/nats-io/nats-server/v2` Go	From `2.10.0`	`2.10.4`

Products include Linuxfoundation Nats-Server, Nats Nkeys.

How do I fix CVE-2023-46129?

Upgrade github.com/nats-io/nkeys to 0.4.6 or later.

Is CVE-2023-46129 being exploited?

There is no known exploitation of CVE-2023-46129 in the wild and no public exploit code.

Sources

Also known as AZL-31792, AZL-35298, BIT-nats-2023-46129, CLEANSTART-2026-JI58569, CLEANSTART-2026-ST31777, DEBIAN-CVE-2023-46129 and 3 more.