Log in Start free

Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-33215NATS is vulnerable to MQTT hijacking via Client ID

Medium 6.5

In plain English

A medium-severity improper authentication in nats-server from nats-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 84.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23nats-server2.12.6-r0ALPINE-CVE-2026-33215
Alpine:v3.24nats-server2.12.6-r0ALPINE-CVE-2026-33215
Debian:12nats-serverno fix listedDEBIAN-CVE-2026-33215
Debian:13nats-serverno fix listedDEBIAN-CVE-2026-33215
Debian:14nats-server2.12.6-1DEBIAN-CVE-2026-33215
Gogithub.com/nats-io/nats-serverno fix listedGO-2026-4833
Gogithub.com/nats-io/nats-server/v22.12.6GHSA-fcjp-h8cc-6879
Gogithub.com/nats-io/nats-server/v22.11.15, 2.12.6GO-2026-4833
Gogithub.com/nats-io/nats-server/v22.11.15GHSA-fcjp-h8cc-6879
Ubuntu:24.04:LTSnats-serverno fix listedUBUNTU-CVE-2026-33215
Ubuntu:25.10nats-serverno fix listedUBUNTU-CVE-2026-33215
Ubuntu:26.10nats-serverno fix listedUBUNTU-CVE-2026-33215

Affected products (as reported)

VendorProductVersions
nats-io nats-server < 2.11.15>= 2.12.0-RC.1, < 2.12.6

Weakness: CWE-287, CWE-488 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

References