CVE-2026-33216 Details
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.
A vulnerability in NATS-Server's MQTT implementation prior to versions 2.11.15 and 2.12.6 allows for the incorrect classification of MQTT passwords as non-authenticating identity statements. This misclassification leads to the exposure of these passwords through monitoring endpoints. The issue arises in MQTT deployments that utilize user codes and passwords.
Users can upgrade to NATS-Server versions 2.12.6 or 2.11.15 to address this vulnerability. It is also recommended to secure monitoring endpoints and avoid exposing them to the Internet or untrusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:21769 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:22347 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:23345 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-33216 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2451448 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33216.json | redhat-SADP | |
| https://advisories.nats.io/CVE/secnote-2026-05.txt | [email protected] | MitigationVendor Advisory |
| https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099 | [email protected] | Patch |
| https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-213 | Exposure of Sensitive Information Due to Incompatible Policies | redhat-SADP |
| CWE-256 | Plaintext Storage of a Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation nats-server | < 2.11.15 >= 2.12.0, < 2.12.6 |
CPE
Remediation
| |
Change History
16 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Sep 7, 2026 | CVE Modified | [email protected] |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 14, 2026 | CVE Modified | redhat-SADP |
| Aug 10, 2026 | CVE Modified | redhat-SADP |
| Aug 3, 2026 | CVE Modified | redhat-SADP |
| Jul 27, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 25, 2026 | New CVE Received | [email protected] |