There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to
    other stream names, impacting data which should have been protected against them. Versions 2.11.15 and
    2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream
    restore permissions, temporarily remove those permissions. (CVE-2026-33222)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are
    incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring
    endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are
    adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other
    untrusted network users. (CVE-2026-33216)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-
    server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can
    by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known
    workarounds are available. (CVE-2026-33215)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the
    `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions 2.11.15 and
    2.12.6 contain a fix. No known workarounds are available. (CVE-2026-33217)

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to
    versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server
    with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a
    workaround, disable leafnode support if not needed or restrict network connections to the leafnode port,
    if plausible without compromising the service offered. (CVE-2026-33218)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - NATS-Server 是適用於雲端與邊緣原生訊息系統 NATS.io 的高效能伺服器。在 2.11.15 和 2.12.6版之前具有 JetStream 管理 API 存取權以還原一個資料流的使用者可還原為其他資料流名稱進而影響本應受到其保護的資料。 2.11.15 和 2.12.6 版包含一個修正。作為因應措施如果開發人員已將使用者設定為擁有有限的 JetStream 還原權限請暫時移除這些權限。 (CVE-2026-33222)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - NATS-Server 是适用于云和边缘原生消息系统 NATS.io 的高性能服务器。在版本 2.11.15 和 2.12.6之前具有 JetStream admin API 访问权限还原一个流的用户可还原到其他流名称从而影响应已针对其提供保护的数据。版本 2.11.15 和 2.12.6 包含一个补丁。作为变通方案如果开发人员已将用户配置为具有有限的 JetStream 还原权限请暂时删除这些权限。 (CVE-2026-33222)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - NATS-Server は、クラウドおよびエッジネイティブメッセージングシステムである NATS.io 向けのハイパフォーマンスサーバーです。バージョン 2.11.15 および 2.12.6より前では、JetStream 管理 API アクセス権を持つユーザーが、1 つのストリームを復元するために、他のストリーム名に復元し、本来保護されているはずのデータに影響を与える可能性がありました。バージョン 2.11.15 と 2.12.6 には修正が含まれています。回避策として、開発者が制限された JetStream 復元権限を有するようにユーザーを構成した場合、一時的にそれらの権限を削除してください。CVE-2026-33222

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to     versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to     other stream names, impacting data which should have been protected against them. Versions 2.11.15 and     2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream     restore permissions, temporarily remove those permissions. (CVE-2026-33222)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
439159	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-9983-vrx2-fg9c)	Tenable Cloud Security	SCA Checks	3/25/2026	7/2/2026	medium
439159	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-9983-vrx2-fg9c)	Tenable Self-Hosted Container Security	SCA Checks	3/25/2026	7/2/2026	medium
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	4/12/2026	7/2/2026	high
440289	Alpine: nats-server: security update to 2.12.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	4/12/2026	7/2/2026	high
303831	Linux Distros 未修補的弱點：CVE-2026-33222	Nessus	Misc.	3/26/2026	5/30/2026	medium
303831	Linux Distros 未修补的漏洞：CVE-2026-33222	Nessus	Misc.	3/26/2026	5/30/2026	medium
303831	Linux Distros のパッチ未適用の脆弱性: CVE-2026-33222	Nessus	Misc.	3/26/2026	5/30/2026	medium
303831	Linux Distros Unpatched Vulnerability : CVE-2026-33222	Nessus	Misc.	3/26/2026	5/30/2026	medium

Detections

Analytics

Plugins Search

medium

medium

high

high

medium

medium

medium

medium