Skip to content
OpenAdvisories
High · 7.4 CVE-2026-33247 BIT-nats-2026-33247EUVD-2026-15975GHSA-x6g4-f6q3-fqvvGO-2026-4827

NATS credentials are exposed in monitoring port via command-line argv

Published Mar 25, 2026 · Updated Sep 9, 2026 · Assigned by GitHub_M

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, if a nats-server is run with static credentials for all clients provided via argv (the command-line), then those credentials are visible to any user who can see the monitoring port, if that too is enabled. The `/debug/vars` end-point contains an unredacted copy of argv. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, configure credentials inside a configuration file instead of via argv, and do not enable the monitoring port if using secrets in argv. Best practice remains to not expose the monitoring port to the Internet, or to untrusted network sources.

Affected products

VendorProductAffectedFixed
nats-io nats-server < 2.11.15, >= 2.12.0-RC.1, < 2.12.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 nats-server 2.12.6-1 —
Debian 13 nats-server No fix yet —
Debian 12 nats-server No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 nats-server No fix yet —
Ubuntu 25.10 nats-server No fix yet —
Ubuntu 24.04 LTS nats-server No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS nats-server No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260326T203309-150000.1.155.2 SUSE-SU-2026:1135-1
ReleasePackageFixed inAdvisory
Alpine v3.24 nats-server 2.12.6-r0 —
Alpine v3.23 nats-server 2.12.6-r0 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling k3s +1 1.35.2.1-r4 —
Wolfi rolling k3s-1.32 +1 1.32.13.1-r7 —
Wolfi rolling kine 0.14.15-r1 —
Wolfi rolling nats 0.3.2-r0 —
Wolfi rolling nats-top 0.6.3-r18 —
Wolfi rolling telegraf-1.38 1.38.1-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/nats-io/nats-server all versions — GO-2026-4827
Go github.com/nats-io/nats-server/v2 < 2.11.15 2.11.15 GHSA-x6g4-f6q3-fqvv
Go github.com/nats-io/nats-server/v2 >= 2.12.0-RC.1, < 2.12.6 2.12.6 GHSA-x6g4-f6q3-fqvv
Go github.com/nats-io/nats-server/v2 < 2.11.15 · >= 2.12.0-RC.1, < 2.12.6 2.11.15, 2.12.6 GO-2026-4827

Advisories 3

References