NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
References
| Link | Resource |
|---|---|
| https://advisories.nats.io/CVE/secnote-2026-15.txt | Vendor Advisory |
| https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Mar 2026, 16:20
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linuxfoundation
Linuxfoundation nats-server |
|
| CPE | cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* | |
| References | () https://advisories.nats.io/CVE/secnote-2026-15.txt - Vendor Advisory | |
| References | () https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j - Vendor Advisory |
25 Mar 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-25 21:16
Updated : 2026-03-26 16:20
NVD link : CVE-2026-33249
Mitre link : CVE-2026-33249
CVE.ORG link : CVE-2026-33249
JSON object : View
Products Affected
linuxfoundation
- nats-server
CWE
CWE-863
Incorrect Authorization