Vulnerability · Published Mar 25, 2026 · Assigned by GitHub_M
CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subject
Medium 4.3
In plain English
A medium-severity incorrect authorization in nats-server from nats-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | nats-server | 2.12.6-r0 | ALPINE-CVE-2026-33249 |
| Alpine:v3.24 | nats-server | 2.12.6-r0 | ALPINE-CVE-2026-33249 |
| Debian:14 | nats-server | 2.12.6-1 | DEBIAN-CVE-2026-33249 |
| Go | github.com/nats-io/nats-server | no fix listed | GO-2026-4826 |
| Go | github.com/nats-io/nats-server/v2 | 2.12.6 | GHSA-8m2x-3m6q-6w8j |
| Go | github.com/nats-io/nats-server/v2 | 2.11.15, 2.12.6 | GO-2026-4826 |
| Go | github.com/nats-io/nats-server/v2 | 2.11.15 | GHSA-8m2x-3m6q-6w8j |
| Ubuntu:24.04:LTS | nats-server | no fix listed | UBUNTU-CVE-2026-33249 |
| Ubuntu:25.10 | nats-server | no fix listed | UBUNTU-CVE-2026-33249 |
| Ubuntu:26.10 | nats-server | no fix listed | UBUNTU-CVE-2026-33249 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nats-io | nats-server | >= 2.11.0, < 2.11.15>= 2.12.0-preview.1, < 2.12.6 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j x_refsource_CONFIRM
- https://advisories.nats.io/CVE/secnote-2026-15.txt x_refsource_MISC