CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCVE-2026-33249
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linuxfoundation:nats-server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8m2x-3m6q-6w8j | Go | github.com/nats-io/nats-server/v2 | >=2.11.0 <2.11.15 | 2.11.15 |
| GHSA-8m2x-3m6q-6w8j | Go | github.com/nats-io/nats-server/v2 | >=2.12.0-preview.1 <2.12.6 | 2.12.6 |
| GO-2026-4826 | Go | github.com/nats-io/nats-server | all versions | no fix published |
| GO-2026-4826 | Go | github.com/nats-io/nats-server/v2 | >=2.11.0 <2.11.15 >=2.12.0-preview.1 <2.12.6 | 2.11.15, 2.12.6 |