Answer in brief
CVE-2020-26892 records a Unknown severity vulnerability in Incorrect handling of credential expiry by /nats-io/nats-server. The current sources do not mark it as known exploited. The current feed maps github.com/nats-io/nats-server/v2 (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps github.com/nats-io/nats-server/v2 (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/nats-io/nats-server/v2go | >=0 <2.1.9 | 2.1.9 |
Published upstream
May 21, 2021
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
(This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26892.txt ) ## Problem Description NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled. The NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API. A new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this. The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it. The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications. ## Affected versions #### JWT library * all versions prior to 1.1.0 * fixed after nats-io/jwt PR 103 landed (2020-10-06) #### NATS Server * Version 2 prior to 2.1.9 + 2.0.0 through and including 2.1.8 are vulnerable. * fixed with nats-io/nats-server PRs 1632, 1635, 1645 ## Impact Time-based credential expiry did not work. ## Workaround Have credentials which only expire after fixes can be deployed. ## Solution Upgrade the JWT dependency in any application using it. Upgrade the NATS server if using NATS Accounts.
Quoted source text, attributed separately from HOL analysis.