NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS
    identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly
    enforced, allowing for authentication bypass. This does require a valid certificate from a CA already
    trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly
    unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in
    their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix.
    As a workaround, developers should review their CA issuing practices. (CVE-2026-33248)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are
    incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring
    endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are
    adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other
    untrusted network users. (CVE-2026-33216)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-
    server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can
    by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known
    workarounds are available. (CVE-2026-33215)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the
    `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and
    2.12.6 contain a fix. No known workarounds are available. (CVE-2026-33217)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server
    with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a
    workaround, disable leafnode support if not needed or restrict network connections to the leafnode port,
    if plausible without compromising the service offered. (CVE-2026-33218)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to     versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS     identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly     enforced, allowing for authentication bypass. This does require a valid certificate from a CA already     trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly     unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in     their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix.
    As a workaround, developers should review their CA issuing practices. (CVE-2026-33248)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463531	Echo: github.com/nats-io/nats-server/v2: security update to 2.11.15	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463531	Echo: github.com/nats-io/nats-server/v2: security update to 2.11.15	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
303841	Linux Distros Unpatched Vulnerability : CVE-2026-33248	Nessus	Misc.	Local	medium
439153	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-3f24-pcvm-5jqc)	Tenable Cloud Security	SCA Checks	Local	medium
439153	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-3f24-pcvm-5jqc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-33248

medium

Tenable Plugins

medium

medium

high

high

medium

medium

medium