NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are
    incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring
    endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are
    adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other
    untrusted network users. (CVE-2026-33216)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-
    server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can
    by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known
    workarounds are available. (CVE-2026-33215)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the
    `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and
    2.12.6 contain a fix. No known workarounds are available. (CVE-2026-33217)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server
    with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a
    workaround, disable leafnode support if not needed or restrict network connections to the leafnode port,
    if plausible without compromising the service offered. (CVE-2026-33218)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-     server offers a `Nats-Request-Info:` message header, providing information about a request. This is     supposed to provide enough information to allow for account/user identification, such that NATS clients     could make their own decisions on how to trust a message, provided that they trust the nats-server as a     broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged     too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS     clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the     nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical     client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known     workarounds are available. (CVE-2026-33246)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-
    server offers a `Nats-Request-Info:` message header, providing information about a request. This is
    supposed to provide enough information to allow for account/user identification, such that NATS clients
    could make their own decisions on how to trust a message, provided that they trust the nats-server as a
    broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged
    too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS
    clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the
    nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical
    client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known
    workarounds are available. (CVE-2026-33246)

ID	Name	Product	Family	Severity
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
303842	Linux Distros Unpatched Vulnerability : CVE-2026-33246	Nessus	Misc.	medium
439155	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-55h8-8g96-x4hj)	Tenable Cloud Security	SCA Checks	medium
439155	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-55h8-8g96-x4hj)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-33246

medium

Tenable Plugins

high

high

medium

medium

medium