CVE-2026-33217 nats-io CVE debrief

Who should care

Security teams and administrators responsible for NATS-Server installations should be aware of this vulnerability. Given the high CVSS score of 7.1, this vulnerability should be prioritized for patching. Organizations using NATS-Server versions prior to 2.11.15 or 2.12.6 are potentially affected.

Technical summary

The vulnerability in NATS-Server arises from the improper application of Access Control Lists (ACLs) on message subjects in the `$MQTT.> namespace. Specifically, ACL checks are bypassed for MQTT subjects, allowing unauthorized access. This issue is resolved in NATS-Server versions 2.11.15 and 2.12.6. The vulnerability is characterized by a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, indicating a high severity. The weakness associated with this vulnerability is CWE-863 (Incorrect Authorization) and CWE-425 (Unprotected Storage of Credentials).

Defensive priority

High. Given the CVSS score of 7.1 and the potential for unauthorized access, this vulnerability should be prioritized for remediation.

Recommended defensive actions

• Upgrade NATS-Server to version 2.11.15 or 2.12.6, or later.
• Review and update ACL configurations for message subjects in the `$MQTT.> namespace.
• Monitor NATS-Server installations for potential exploitation attempts.
• Implement compensating controls, such as additional authentication or logging, if immediate patching is not feasible.
• Track vendor advisories for further information and updates.

Evidence notes

The CVE-2026-33217 vulnerability was publicly disclosed on March 25, 2026, and the CVE record was last modified on June 30, 2026. The vulnerability affects NATS-Server versions prior to 2.11.15 and 2.12.6. The CVSS score of 7.1 indicates a high severity. There are no known workarounds for this vulnerability.

Official resources