Skip to content
OpenAdvisories
High WID-SEC-2026-0858 11 CVEs

NATS Server: Mehrere Schwachstellen

Published Mar 24, 2026 · Updated Jun 1, 2026 · Revision 3 · de-DE

Vendor: Red Hat Product: Enterprise Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.

Product

Der NATS-Server ist ein Server für NATS.io, das Cloud- und Edge-native Messaging-System.

Vulnerabilities 11

  • High 8.6
    CVE-2026-33216

    NATS has MQTT plaintext password disclosure

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity st…

    nats-io nats-server k3s k3s-static Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-33218

    NATS has pre-auth server panic via leafnode handling

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication…

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • High 7.4
    CVE-2026-33247

    NATS credentials are exposed in monitoring port via command-line argv

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, if a nats-server is run with static credentials for all clients provided via argv (the command-line), then those credentials …

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • High 7.1
    CVE-2026-33217

    NATS allows MQTT clients to bypass ACL checks

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass …

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • Medium 6.5
    CVE-2026-33215

    NATS is vulnerable to MQTT hijacking via Client ID

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Vers…

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • Medium 6.4
    CVE-2026-33223

    NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping …

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • Medium 6.4
    CVE-2026-33246

    NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for ac…

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • Medium 5.3
    CVE-2026-33219

    NATS is vulnerable to pre-auth DoS through WebSockets client service

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authenti…

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • Medium 4.9
    CVE-2026-33222

    NATS JetStream has an authorization bypass through its Management API

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should …

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • Medium 4.3
    CVE-2026-33249

    NATS: Message tracing can be redirected to arbitrary subject

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be …

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go
  • Medium 4.2
    CVE-2026-33248

    NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

    NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN…

    nats-io nats-server k3s k3s-static Debian Ubuntu Alpine Wolfi Go

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-15973, EUVD-2026-15970, EUVD-2026-15968, EUVD-2026-15964, EUVD-2026-15975, EUVD-2026-15994, EUVD-2026-15996, EUVD-2026-15999, EUVD-2026-16000, EUVD-2026-15966

  3. #1

    Initiale Fassung

References