CVE-2026-33215

medium

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

References

https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-15017

https://advisories.nats.io/CVE/secnote-2026-06.tx

Details

Source: Mitre, NVD

Published: 2026-03-24

Updated: 2026-03-26

Named Vulnerability: GO-2026-4833Named Vulnerability: GHSA-fcjp-h8cc-6879

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.00292