CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2026-33215
Medium (6.5) in linuxfoundation nats-server. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/nats-io/nats-server/v2 2.11.15, 2.12.6.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-287, CWE-488
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linuxfoundation:nats-server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fcjp-h8cc-6879 | Go | github.com/nats-io/nats-server/v2 | <2.11.15 | 2.11.15 |
| GHSA-fcjp-h8cc-6879 | Go | github.com/nats-io/nats-server/v2 | >=2.12.0-RC.1 <2.12.6 | 2.12.6 |
| GO-2026-4833 | Go | github.com/nats-io/nats-server | all versions | no fix published |
| GO-2026-4833 | Go | github.com/nats-io/nats-server/v2 | <2.11.15 >=2.12.0-RC.1 <2.12.6 | 2.11.15, 2.12.6 |