There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are
    incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring
    endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are
    adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other
    untrusted network users. (CVE-2026-33216)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-
    server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can
    by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known
    workarounds are available. (CVE-2026-33215)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the
    `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and
    2.12.6 contain a fix. No known workarounds are available. (CVE-2026-33217)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server
    with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a
    workaround, disable leafnode support if not needed or restrict network connections to the leafnode port,
    if plausible without compromising the service offered. (CVE-2026-33218)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting
    in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing
    headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to
    which the client does not have publish permission. The payload is a valid trace message and not chosen by
    the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
    (CVE-2026-33249)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - NATS-Server 是適用於雲端與邊緣原生訊息系統 NATS.io 的高效能伺服器。從 2.11.0 版和 [] 版 2.11.15 和 2.12.6版之前的版本中開始使用訊息追踪標頭的有效用戶端可指示追踪訊息可傳送至任意有效主體包括用戶端沒有發布權限的主體。承載是有效的追踪訊息且不是由攻擊者選擇。 2.11.15 和 2.12.6 版包含一個修正。目前尚無已知的因應措施。
    (CVE-2026-33249)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - NATS-Server 是适用于云和边缘原生消息系统 NATS.io 的高性能服务器。从 2.11.0 版本开始到低于 2.11.15 和 2.12.6的版本中使用消息跟踪标头的有效客户端可以指示跟踪消息可以发送到任意有效的主题包括客户端没有发布权限的主题。负载为有效的跟踪消息，未经攻击者选择。版本 2.11.15 和 2.12.6 包含一个补丁。目前尚无已知的解决方法。
    (CVE-2026-33249)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - NATS-Server は、クラウドおよびエッジネイティブメッセージングシステムである NATS.io 向けのハイパフォーマンスサーバーです。バージョン 2.11.0 から、バージョン 2.11.15 と 2.12.6より前のために、メッセージトレースヘッダーを使用する有効なクライアントは、トレースメッセージが、クライアントが公開権限を持たないものを含む任意の有効なサブジェクトに送信できることを示します。ペイロードは有効なトレースメッセージであり、攻撃者によって選択されていません。バージョン 2.11.15 と 2.12.6 には修正が含まれています。既知の回避策はありません。
    (CVE-2026-33249)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting     in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing     headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to     which the client does not have publish permission. The payload is a valid trace message and not chosen by     the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
    (CVE-2026-33249)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	4/12/2026	7/2/2026	high
439167	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-8m2x-3m6q-6w8j)	Tenable Cloud Security	SCA Checks	3/25/2026	7/2/2026	medium
439167	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-8m2x-3m6q-6w8j)	Tenable Self-Hosted Container Security	SCA Checks	3/25/2026	7/2/2026	medium
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	4/12/2026	7/2/2026	high
303845	Linux Distros 未修補的弱點：CVE-2026-33249	Nessus	Misc.	3/26/2026	9/14/2026	medium
303845	Linux Distros 未修补的漏洞：CVE-2026-33249	Nessus	Misc.	3/26/2026	9/14/2026	medium
303845	Linux Distros のパッチ未適用の脆弱性: CVE-2026-33249	Nessus	Misc.	3/26/2026	9/14/2026	medium
303845	Linux Distros Unpatched Vulnerability : CVE-2026-33249	Nessus	Misc.	3/26/2026	9/14/2026	medium

Detections

Analytics

Plugins Search

high

medium

medium

high

medium

medium

medium

medium