Log in Start free

Vulnerability · Published Mar 25, 2026 · Assigned by GitHub_M

CVE-2026-33246NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

Medium 6.4

In plain English

A medium-severity improper authentication in nats-server from nats-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.1%top 95.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23nats-server2.12.6-r0ALPINE-CVE-2026-33246
Alpine:v3.24nats-server2.12.6-r0ALPINE-CVE-2026-33246
Debian:12nats-serverno fix listedDEBIAN-CVE-2026-33246
Debian:13nats-serverno fix listedDEBIAN-CVE-2026-33246
Debian:14nats-server2.12.6-1DEBIAN-CVE-2026-33246
Gogithub.com/nats-io/nats-serverno fix listedGHSA-55h8-8g96-x4hj
Gogithub.com/nats-io/nats-serverno fix listedGO-2026-4830
Gogithub.com/nats-io/nats-server/v22.12.6GHSA-55h8-8g96-x4hj
Gogithub.com/nats-io/nats-server/v22.11.15GHSA-55h8-8g96-x4hj
Gogithub.com/nats-io/nats-server/v22.11.15, 2.12.6GO-2026-4830
Ubuntu:24.04:LTSnats-serverno fix listedUBUNTU-CVE-2026-33246
Ubuntu:25.10nats-serverno fix listedUBUNTU-CVE-2026-33246
Ubuntu:26.10nats-serverno fix listedUBUNTU-CVE-2026-33246

Affected products (as reported)

VendorProductVersions
nats-io nats-server < 2.11.15>= 2.12.0-RC.1, < 2.12.6

Weakness: CWE-287, CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References