CVE-2026-33246 Details
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
A vulnerability exists in NATS-Server versions prior to 2.11.15 and 2.12.6, allowing for spoofing of identity information in the Nats-Request-Info message header. This header is intended to facilitate account or user identification, enabling NATS clients to make trust decisions about messages based on their confidence in the nats-server as a broker. However, leafnodes connecting to a nats-server are not fully trusted unless the system account is also bridged, leading to unchecked propagation of identity claims. While this vulnerability does not directly impact the nats-server itself, it could affect how clients interpret the Nats-Request-Info header, with potential implications for message trustworthiness.
Users can upgrade to NATS-Server versions 2.12.6 or 2.11.15 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://advisories.nats.io/CVE/secnote-2026-08.txt | [email protected] | Vendor Advisory |
| https://github.com/nats-io/nats-server/security/advisories/GHSA-55h8-8g96-x4hj | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation nats-server | < 2.11.15 >= 2.12.0, < 2.12.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 25, 2026 | New CVE Received | [email protected] |